[freetype2] master 052f6c5: [truetype] Another GX sanity test.

[Werner LEMBERG]

branch: master
commit 052f6c5649f7a46e599742eb6f47fa91d090f77e
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [truetype] Another GX sanity test.
    
    * src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Check
    `tupleCount'.
    Add tracing message.
---
 ChangeLog              |    8 ++++++++
 src/truetype/ttgxvar.c |   17 ++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 96e45a6..ba383ef 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2015-10-13  Werner Lemberg  <address@hidden>
 
+       [truetype] Another GX sanity test.
+
+       * src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Check
+       `tupleCount'.
+       Add tracing message.
+
+2015-10-13  Werner Lemberg  <address@hidden>
+
        [truetype] Fix memory leak for broken GX fonts (#46188).
 
        * src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Fix scope of
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 2f11504..3ae31d6 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1864,7 +1864,19 @@
       goto Fail2;
 
     tupleCount   = FT_GET_USHORT();
-    offsetToData = glyph_start + FT_GET_USHORT();
+    offsetToData = FT_GET_USHORT();
+
+    /* rough sanity test */
+    if ( offsetToData + tupleCount * 4 > stream->size - stream->pos )
+    {
+      FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
+                  " invalid glyph variation array header\n" ));
+
+      error = FT_THROW( Invalid_Table );
+      goto Fail2;
+    }
+
+    offsetToData += glyph_start;
 
     if ( tupleCount & GX_TC_TUPLES_SHARE_POINT_NUMBERS )
     {
@@ -1901,6 +1913,9 @@
       }
       else if ( ( tupleIndex & GX_TI_TUPLE_INDEX_MASK ) >= blend->tuplecount )
       {
+        FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
+                    " invalid tuple index\n" ));
+
         error = FT_THROW( Invalid_Table );
         goto Fail2;
       }