Commit 5e227133c16c1c9ff41a18a2b411a20afe81be6c
2022-01-15T17:08:18
[pshinter] Avoid accessing uninitialized zone. The `normal_top.count` may be 0, implying no `normal_top.zones` exist. The code must not access these (non-existent) `normal_top.zones`. * src/pshinter/pshalgo.c (ps_hints_apply): Do not assume that `normal_top.zones[0]` is initialized. Test `normal_top.count` before using `normal_top.zones[0]`. Do not rescale if there are no `zones`. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43675
diff --git a/src/pshinter/pshalgo.c b/src/pshinter/pshalgo.c
index d684263..1616c43 100644
--- a/src/pshinter/pshalgo.c
+++ b/src/pshinter/pshalgo.c
@@ -2110,14 +2110,17 @@
FT_Fixed old_x_scale = x_scale;
FT_Fixed old_y_scale = y_scale;
- FT_Fixed scaled;
- FT_Fixed fitted;
+ FT_Fixed scaled = 0;
+ FT_Fixed fitted = 0;
FT_Bool rescale = FALSE;
- scaled = FT_MulFix( globals->blues.normal_top.zones->org_ref, y_scale );
- fitted = FT_PIX_ROUND( scaled );
+ if ( globals->blues.normal_top.count )
+ {
+ scaled = FT_MulFix( globals->blues.normal_top.zones->org_ref, y_scale );
+ fitted = FT_PIX_ROUND( scaled );
+ }
if ( fitted != 0 && scaled != fitted )
{