[truetype] Reject elements of composites with invalid glyph indices. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8413 * src/truetype/ttgload.c (TT_Load_Composite_Glyph): Implement it.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129
diff --git a/ChangeLog b/ChangeLog
index f6f2787..789ac94 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,15 @@
2018-05-22 Werner Lemberg <wl@gnu.org>
+ [truetype] Reject elements of composites with invalid glyph indices.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8413
+
+ * src/truetype/ttgload.c (TT_Load_Composite_Glyph): Implement it.
+
+2018-05-22 Werner Lemberg <wl@gnu.org>
+
* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Trace # of points.
2018-05-20 Werner Lemberg <wl@gnu.org>
diff --git a/include/freetype/config/ftheader.h b/include/freetype/config/ftheader.h
index 702f77c..13e5de7 100644
--- a/include/freetype/config/ftheader.h
+++ b/include/freetype/config/ftheader.h
@@ -760,6 +760,18 @@
#define FT_ADVANCES_H <freetype/ftadvanc.h>
+ /*************************************************************************
+ *
+ * @macro:
+ * FT_COLOR_H
+ *
+ * @description:
+ * A macro used in #include statements to name the file containing the
+ * FreeType~2 API which handles the OpenType CPAL table.
+ */
+#define FT_COLOR_H <freetype/ftcolor.h>
+
+
/* */
/* These header files don't need to be included by the user. */
diff --git a/include/freetype/ftbitmap.h b/include/freetype/ftbitmap.h
index cbdccc2..f3acd19 100644
--- a/include/freetype/ftbitmap.h
+++ b/include/freetype/ftbitmap.h
@@ -22,6 +22,7 @@
#include <ft2build.h>
#include FT_FREETYPE_H
+#include FT_COLOR_H
#ifdef FREETYPE_H
#error "freetype.h of FreeType 1 has been loaded!"
@@ -185,6 +186,43 @@ FT_BEGIN_HEADER
/*************************************************************************/
/* */
/* <Function> */
+ /* FT_Bitmap_Blend */
+ /* */
+ /* <Description> */
+ /* Blend a bitmap object from an `FT_GlyphSlot' structure onto a */
+ /* bitmap in an `FT_Bitmap' structure, using a given color and */
+ /* offset. */
+ /* */
+ /* <InOut> */
+ /* target :: A handle to a bitmap object. Its type must be */
+ /* @FT_PIXEL_MODE_BGRA. */
+ /* */
+ /* <Input> */
+ /* source :: The glyph slot's source bitmap, which can have any */
+ /* @FT_Pixel_Mode format. */
+ /* */
+ /* color :: The color used to draw `source' onto `target'. */
+ /* */
+ /* topleft :: A vector from the topleft corner of `source' to the */
+ /* topleft corner of `target'. */
+ /* */
+ /* <Return> */
+ /* FreeType error code. 0~means success. */
+ /* */
+ /* <Note> */
+ /* This function reallocates the target bitmap if necessary; it */
+ /* doesn't perform clipping. */
+ /* */
+ FT_EXPORT( FT_Error )
+ FT_Bitmap_Blend( FT_Bitmap target,
+ FT_GlyphSlot source,
+ FT_Color color,
+ FT_Vector topleft );
+
+
+ /*************************************************************************/
+ /* */
+ /* <Function> */
/* FT_GlyphSlot_Own_Bitmap */
/* */
/* <Description> */
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 33ca681..f7f723a 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -561,9 +561,10 @@
TT_Load_Composite_Glyph( TT_Loader loader )
{
FT_Error error;
- FT_Byte* p = loader->cursor;
- FT_Byte* limit = loader->limit;
- FT_GlyphLoader gloader = loader->gloader;
+ FT_Byte* p = loader->cursor;
+ FT_Byte* limit = loader->limit;
+ FT_GlyphLoader gloader = loader->gloader;
+ FT_Long num_glyphs = loader->face->root.num_glyphs;
FT_SubGlyph subglyph;
FT_UInt num_subglyphs;
@@ -592,6 +593,11 @@
subglyph->flags = FT_NEXT_USHORT( p );
subglyph->index = FT_NEXT_USHORT( p );
+ /* we reject composites that have components */
+ /* with invalid glyph indices */
+ if ( subglyph->index >= num_glyphs )
+ goto Invalid_Composite;
+
/* check space */
count = 2;
if ( subglyph->flags & ARGS_ARE_WORDS )