Commit 7e1b39f6cd1f8e14d45592c9b192ade643d8d9de
2019-12-16T11:07:58
[truetype] Fix UBSan warnings on adding offsets to nullptr. Reported as https://bugs.chromium.org/p/chromium/issues/detail?id=1032152 * src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
diff --git a/ChangeLog b/ChangeLog
index 720a38c..a93b43d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-12-16 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Fix UBSan warnings on adding offsets to nullptr.
+
+ Reported as
+
+ https://bugs.chromium.org/p/chromium/issues/detail?id=1032152
+
+ * src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.
+
2019-12-14 Werner Lemberg <wl@gnu.org>
[truetype] Fix integer overflow.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 7d021eb..369c7b5 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -3718,7 +3718,7 @@
/* We will then parse the current table. */
rec = exc->FDefs;
- limit = rec + exc->numFDefs;
+ limit = FT_OFFSET( rec, exc->numFDefs );
n = (FT_ULong)args[0];
for ( ; rec < limit; rec++ )
@@ -4150,7 +4150,7 @@
/* First of all, look for the same function in our table */
def = exc->IDefs;
- limit = def + exc->numIDefs;
+ limit = FT_OFFSET( def, exc->numIDefs );
for ( ; def < limit; def++ )
if ( def->opc == (FT_ULong)args[0] )