[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master 2550fc7: [cff] Fix heap buffer overflow in old engine
From: |
Werner LEMBERG |
Subject: |
[freetype2] master 2550fc7: [cff] Fix heap buffer overflow in old engine. |
Date: |
Sat, 18 Aug 2018 07:39:04 -0400 (EDT) |
branch: master
commit 2550fc75a56f18aff2a6543a1ad07724b5f97767
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[cff] Fix heap buffer overflow in old engine.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
non-zero.
---
ChangeLog | 12 ++++++++++++
src/psaux/cffdecode.c | 3 +++
2 files changed, 15 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index e2dd621..4e30cdc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2018-08-14 Werner Lemberg <address@hidden>
+
+ [cff] Fix heap buffer overflow in old engine.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
+
+ * src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
+ <cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
+ non-zero.
+
2018-08-16 Young Xiao <address@hidden>
* builds/mac/ftmac.c (parse_fond): Fix buffer overrun.
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 5732beb..3f4cfd4 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -1935,6 +1935,7 @@
case cff_op_blend:
/* this operator was removed from the Type2 specification */
/* in version 16-March-2000 */
+ if ( num_designs )
{
FT_Int num_results = (FT_Int)( args[0] >> 16 );
@@ -1953,6 +1954,8 @@
args -= num_results * ( num_designs - 1 );
num_args -= num_results * ( num_designs - 1 );
}
+ else
+ goto Syntax_Error;
break;
case cff_op_dotsection:
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master 2550fc7: [cff] Fix heap buffer overflow in old engine.,
Werner LEMBERG <=