diff options
| author | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2010-09-20 01:07:57 +0900 |
|---|---|---|
| committer | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2010-09-20 01:16:39 +0900 |
| commit | 643d49df0919b56c6603ab9310839899b77aad8a (patch) | |
| tree | 5b4fadf18cc480fbf9f3f2c329a4da60ecdb5b6f /src/truetype | |
| parent | 900e7e0cdeed5d622cd3d67233b85712e8cb3763 (diff) | |
[truetype] Sanitize the broken offsets in `loca'.
* src/truetype/ttpload.c (tt_face_get_location): If `pos1', the
offset to the requested entry in `glyf' exceeds the end of the
table, return offset=0, length=0. If `pos2', the offset to the
next entry in `glyf' exceeds the end of the table, truncate
the entry length at the end of `glyf' table.
See Savannah bug #31040.
Diffstat (limited to 'src/truetype')
| -rw-r--r-- | src/truetype/ttpload.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index a311b03c..c5317335 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -203,6 +203,26 @@ } } + /* Check broken location data */ + if ( pos1 >= face->glyf_len ) + { + FT_TRACE1(( "tt_face_get_location:" + " too large offset=0x%08lx found for gid=0x%04lx," + " exceeding the end of glyf table (0x%08lx)\n", + pos1, gindex, face->glyf_len )); + *asize = 0; + return 0; + } + + if ( pos2 >= face->glyf_len ) + { + FT_TRACE1(( "tt_face_get_location:" + " too large offset=0x%08lx found for gid=0x%04lx," + " truncate at the end of glyf table (0x%08lx)\n", + pos2, gindex + 1, face->glyf_len )); + pos2 = face->glyf_len; + } + /* The `loca' table must be ordered; it refers to the length of */ /* an entry as the difference between the current and the next */ /* position. However, there do exist (malformed) fonts which */ |