Commit 2550fc75a56f18aff2a6543a1ad07724b5f97767
2018-08-18T13:38:48
[cff] Fix heap buffer overflow in old engine. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) <cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be non-zero.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
diff --git a/ChangeLog b/ChangeLog
index e2dd621..4e30cdc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2018-08-14 Werner Lemberg <wl@gnu.org>
+
+ [cff] Fix heap buffer overflow in old engine.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967
+
+ * src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
+ <cff_op_blend> [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be
+ non-zero.
+
2018-08-16 Young Xiao <yangx92@hotmail.com>
* builds/mac/ftmac.c (parse_fond): Fix buffer overrun.
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 5732beb..3f4cfd4 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -1935,6 +1935,7 @@
case cff_op_blend:
/* this operator was removed from the Type2 specification */
/* in version 16-March-2000 */
+ if ( num_designs )
{
FT_Int num_results = (FT_Int)( args[0] >> 16 );
@@ -1953,6 +1954,8 @@
args -= num_results * ( num_designs - 1 );
num_args -= num_results * ( num_designs - 1 );
}
+ else
+ goto Syntax_Error;
break;
case cff_op_dotsection: