diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-08-18 13:38:48 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-08-18 13:38:48 +0200 |
| commit | 2550fc75a56f18aff2a6543a1ad07724b5f97767 (patch) | |
| tree | 5e4c2b67b9c5ae20abd09d16a5ad69cea4bb2fc1 /src/psaux | |
| parent | c94162a2200c16e9614289cf91d6bf0e0b01a01f (diff) | |
| download | freetype2-2550fc75a56f18aff2a6543a1ad07724b5f97767.tar.gz | |
[cff] Fix heap buffer overflow in old engine.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
non-zero.
Diffstat (limited to 'src/psaux')
| -rw-r--r-- | src/psaux/cffdecode.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index 5732beb8a..3f4cfd42b 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -1935,6 +1935,7 @@ case cff_op_blend: /* this operator was removed from the Type2 specification */ /* in version 16-March-2000 */ + if ( num_designs ) { FT_Int num_results = (FT_Int)( args[0] >> 16 ); @@ -1953,6 +1954,8 @@ args -= num_results * ( num_designs - 1 ); num_args -= num_results * ( num_designs - 1 ); } + else + goto Syntax_Error; break; case cff_op_dotsection: |