diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-11-06 11:08:41 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-11-06 11:08:41 +0100 |
| commit | 5b86f53dd60c7545dcea75684561199ac3d3e90f (patch) | |
| tree | e1f95d64d5b922649d7e51cb9bca6c8ea594ca0d | |
| parent | cc288e383bbb95442f3ed72539917323bd1dabbf (diff) | |
| download | freetype2-5b86f53dd60c7545dcea75684561199ac3d3e90f.tar.gz | |
[psaux] Fix timeout in old CFF engine.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11260
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_sqrt> [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix potential endless
loop.
| -rw-r--r-- | ChangeLog | 12 | ||||
| -rw-r--r-- | src/psaux/cffdecode.c | 5 |
2 files changed, 16 insertions, 1 deletions
@@ -1,3 +1,15 @@ +2018-11-06 Werner Lemberg <wl@gnu.org> + + [psaux] Fix timeout in old CFF engine. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11260 + + * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) + <cff_op_sqrt> [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix potential endless + loop. + 2018-11-04 Alexei Podtelezhnikov <apodtele@gmail.com> * src/truetype/ttgxvar.c: Use enum definitions. diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index ac1bc1fe2..09a77cd3c 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -1748,7 +1748,10 @@ case cff_op_sqrt: FT_TRACE4(( " sqrt\n" )); - if ( args[0] > 0 ) + /* without upper limit the loop below might not finish */ + if ( args[0] > 0x7FFFFFFFL ) + args[0] = 46341; + else if ( args[0] > 0 ) { FT_Fixed root = args[0]; FT_Fixed new_root; |