shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[sfnt] Sanitize cmap4 table better.

Fixes #1062.

* src/sfnt/ttcmap.c (tt_cmap4_validate): Handle a too-small value of
`length` gracefully.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,12 @@

+2021-06-08  Werner Lemberg  <wl@gnu.org>

+

+	[sfnt] Sanitize cmap4 table better.

+

+	Fixes #1062.

+

+	* src/sfnt/ttcmap.c (tt_cmap4_validate): Handle a too-small value of

+	`length` gracefully.

+

 2021-06-08  Dominik Röttsches  <drott@chromium.org>

 	[sfnt] Pointer validity check when reading COLR 'v1' layers

--- a/src/sfnt/ttcmap.c

+++ b/src/sfnt/ttcmap.c

@@ -916,6 +916,16 @@

       length = (FT_UInt)( valid->limit - table );

     }

+    /* it also happens that the `length' field is too small; */

+    /* this is easy to correct                               */

+    if ( length < (FT_UInt)( valid->limit - table ) )

+    {

+      if ( valid->level >= FT_VALIDATE_PARANOID )

+        FT_INVALID_DATA;

+

+      length = (FT_UInt)( valid->limit - table );

+    }

+

     if ( length < 16 )

       FT_INVALID_TOO_SHORT;