shithub: freetype+ttf2subf

Download patch

ref: 7f7333990ce65b0251535fe181ef1fce30219bb1
parent: b44e6c2035121ae923730b5d864450774640933c
author: Werner Lemberg <[email protected]>
date: Thu Dec 22 05:12:17 EST 2016 

* src/base/ftrfork.c (FT_Raccess_Get_DataOffsets): Check `count'.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=308

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-12-22  Werner Lemberg  <[email protected]>
 
+	* src/base/ftrfork.c (FT_Raccess_Get_DataOffsets): Check `count'.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=308
+
+2016-12-22  Werner Lemberg  <[email protected]>
+
 	[cff] Protect against invalid `vsindex' and `blend' values.
 
 	Reported as
--- a/src/base/ftrfork.c
+++ b/src/base/ftrfork.c
@@ -248,7 +248,9 @@
         *count = subcnt + 1;
         rpos  += map_offset;
 
-        if ( *count > 2727 )
+        /* a zero count might be valid in the resource specification, */
+        /* however, it is completely useless to us                    */
+        if ( *count < 1 || *count > 2727 )
           return FT_THROW( Invalid_Table );
 
         error = FT_Stream_Seek( stream, (FT_ULong)rpos );