Commit 447a0b62634802d8acdb56008cff5ff4e50be244
2017-03-13T07:42:34
[truetype] Ignore invalid MVAR tags. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=838 * src/truetype/ttgxvar.c (ft_var_load_mvar): Ignore value and emit warning for invalid tags. (tt_apply_mvar): Ignore invalid tags.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74
diff --git a/ChangeLog b/ChangeLog
index 6fb4fc9..091724f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2017-03-13 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Ignore invalid MVAR tags.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=838
+
+ * src/truetype/ttgxvar.c (ft_var_load_mvar): Ignore value and emit
+ warning for invalid tags.
+ (tt_apply_mvar): Ignore invalid tags.
+
2017-03-12 Werner Lemberg <wl@gnu.org>
[truetype] Store and use design coordinates also.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 5abcd02..3277905 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1263,7 +1263,16 @@
FT_Short* p = ft_var_get_value_pointer( face, value->tag );
- value->unmodified = *p;
+ if ( p )
+ value->unmodified = *p;
+#ifdef FT_DEBUG_LEVEL_TRACE
+ else
+ FT_TRACE1(( "ft_var_load_mvar: Ignoring unknown tag `%c%c%c%c'\n",
+ (FT_Char)( value->tag >> 24 ),
+ (FT_Char)( value->tag >> 16 ),
+ (FT_Char)( value->tag >> 8 ),
+ (FT_Char)( value->tag ) ));
+#endif
}
face->variation_support |= TT_FACE_FLAG_VAR_MVAR;
@@ -1320,17 +1329,20 @@
value->outerIndex,
value->innerIndex );
- FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
- (FT_Char)( value->tag >> 24 ),
- (FT_Char)( value->tag >> 16 ),
- (FT_Char)( value->tag >> 8 ),
- (FT_Char)( value->tag ),
- value->unmodified,
- delta ));
-
- /* since we handle both signed and unsigned values as FT_Short, */
- /* ensure proper overflow arithmetic */
- *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+ if ( p )
+ {
+ FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
+ (FT_Char)( value->tag >> 24 ),
+ (FT_Char)( value->tag >> 16 ),
+ (FT_Char)( value->tag >> 8 ),
+ (FT_Char)( value->tag ),
+ value->unmodified,
+ delta ));
+
+ /* since we handle both signed and unsigned values as FT_Short, */
+ /* ensure proper overflow arithmetic */
+ *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+ }
}
/* adjust all derived values */