Commit 10e54d04b975cf8a879b18ed0383bb4be8b1a7d5
2018-09-13T21:47:35
[truetype] Some fixes for VF checks. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10317 * src/truetype/ttgxvar.c (ft_var_load_gvar): Properly exit memory frame if we have invalid glyph variation data offsets. (tt_face_vary_cvt): Protect against missing `tuplecoords' array. Fix typo.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85
diff --git a/ChangeLog b/ChangeLog
index 004fc4b..be013e4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,18 @@
2018-09-13 Werner Lemberg <wl@gnu.org>
+ [truetype] Some fixes for VF checks.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10317
+
+ * src/truetype/ttgxvar.c (ft_var_load_gvar): Properly exit memory
+ frame if we have invalid glyph variation data offsets.
+ (tt_face_vary_cvt): Protect against missing `tuplecoords' array.
+ Fix typo.
+
+2018-09-13 Werner Lemberg <wl@gnu.org>
+
* src/sfnt/sfdriver.c (sfnt_get_var_ps_name): Fix last commit.
2018-09-13 Werner Lemberg <wl@gnu.org>
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index bb6c684..9f41d0e 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1548,11 +1548,9 @@
" invalid glyph variation data offset for index %d\n",
i ));
error = FT_THROW( Invalid_Table );
- goto Exit;
+ break;
}
}
-
- FT_FRAME_EXIT();
}
else
{
@@ -1573,13 +1571,15 @@
" invalid glyph variation data offset for index %d\n",
i ));
error = FT_THROW( Invalid_Table );
- goto Exit;
+ break;
}
}
-
- FT_FRAME_EXIT();
}
+ FT_FRAME_EXIT();
+ if ( error )
+ goto Exit;
+
if ( blend->tuplecount != 0 )
{
if ( FT_NEW_ARRAY( blend->tuplecoords,
@@ -3263,13 +3263,24 @@
" invalid tuple index\n" ));
error = FT_THROW( Invalid_Table );
- goto Exit;
+ goto FExit;
}
else
+ {
+ if ( !blend->tuplecoords )
+ {
+ FT_TRACE2(( "tt_face_vary_cvt:"
+ " no valid tuple coordinates available\n" ));
+
+ error = FT_THROW( Invalid_Table );
+ goto FExit;
+ }
+
FT_MEM_COPY(
tuple_coords,
&blend->tuplecoords[( tupleIndex & 0xFFF ) * blend->num_axis],
blend->num_axis * sizeof ( FT_Fixed ) );
+ }
if ( tupleIndex & GX_TI_INTERMEDIATE_TUPLE )
{