Commit 757bdf1aef3d93a27968857ac5b4435a52fa24a0
2018-08-14T02:02:26
[cff] Fix segv. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9864 * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) <cff_op_random> [CFF_CONFIG_OPTION_OLD_ENGINE]: Use top dict's `random' field directly if parsing dictionaries.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53
diff --git a/ChangeLog b/ChangeLog
index 5b43aa7..227e94e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2018-08-14 Werner Lemberg <wl@gnu.org>
+
+ [cff] Fix segv.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9864
+
+ * src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
+ <cff_op_random> [CFF_CONFIG_OPTION_OLD_ENGINE]: Use top dict's
+ `random' field directly if parsing dictionaries.
+
2018-08-13 Alexei Podtelezhnikov <apodtele@gmail.com>
[bdf] Use unsigned types.
diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 024eb9c..3f4ea15 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -1712,16 +1712,20 @@
break;
case cff_op_random:
- FT_TRACE4(( " random\n" ));
+ {
+ FT_UInt32* randval = in_dict ? &decoder->cff->top_font.random
+ : &decoder->current_subfont->random;
- /* only use the lower 16 bits of `random' */
- /* to generate a number in the range (0;1] */
- args[0] = (FT_Fixed)
- ( ( decoder->current_subfont->random & 0xFFFF ) + 1 );
- args++;
- decoder->current_subfont->random =
- cff_random( decoder->current_subfont->random );
+ FT_TRACE4(( " random\n" ));
+
+ /* only use the lower 16 bits of `random' */
+ /* to generate a number in the range (0;1] */
+ args[0] = (FT_Fixed)( ( *randval & 0xFFFF ) + 1 );
+ args++;
+
+ *randval = cff_random( *randval );
+ }
break;
case cff_op_mul: