shithub: freetype+ttf2subf

Download patch

ref: c4a1ef3c948f261e4402fa48512555279379a683
parent: c4cd34a9e0f95704c256c1f9ab558bedf4a8129b
author: Werner Lemberg <[email protected]>
date: Wed Dec 28 16:22:45 EST 2016 

[cff] Catch `blend' op in non-variant fonts.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=334

* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdBLEND>: Don't
allow `blend' op for non-variant fonts.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
 2016-12-28  Werner Lemberg  <[email protected]>
 
+	[cff] Catch `blend' op in non-variant fonts.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=334
+
+	* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdBLEND>: Don't
+	allow `blend' op for non-variant fonts.
+
+2016-12-28  Werner Lemberg  <[email protected]>
+
 	[cff] Better check of number of blends.
 
 	* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdBLEND>,
--- a/src/cff/cf2intrp.c
+++ b/src/cff/cf2intrp.c
@@ -678,6 +678,13 @@
           if ( !font->isCFF2 )
             break;    /* clear stack & ignore */
 
+          /* do we have a `blend' op in a non-variant font? */
+          if ( !font->blend.font )
+          {
+            lastError = FT_THROW( Invalid_Glyph_Format );
+            goto exit;
+          }
+
           /* check cached blend vector */
           if ( cff_blend_check_vector( &font->blend,
                                        font->vsindex,