Commit 9960e7beabe3fa962fe5a3a020dfd97b40e93f10
2018-06-16T22:16:03
[sfnt] Fix color glyph layer loading. * src/sfnt/ttcolr.c (Colr): Add `table_size' field. (tt_face_load_colr): Set it. (tt_face_get_colr_layer): Check pointer limit for layer entries.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70
diff --git a/ChangeLog b/ChangeLog
index 3f53703..6ac9ead 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
2018-06-16 Werner Lemberg <wl@gnu.org>
+ [sfnt] Fix color glyph layer loading.
+
+ * src/sfnt/ttcolr.c (Colr): Add `table_size' field.
+ (tt_face_load_colr): Set it.
+ (tt_face_get_colr_layer): Check pointer limit for layer entries.
+
+2018-06-16 Werner Lemberg <wl@gnu.org>
+
[sfnt] Fix color palette loading.
Reported as
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index 7e44d42..4fc4300 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -64,7 +64,8 @@
FT_Byte* layers;
/* The memory which backs up the `COLR' table. */
- void* table;
+ void* table;
+ FT_ULong table_size;
} Colr;
@@ -138,6 +139,7 @@
colr->base_glyphs = (FT_Byte*)( table + base_glyph_offset );
colr->layers = (FT_Byte*)( table + layer_offset );
colr->table = table;
+ colr->table_size = table_size;
face->colr = colr;
@@ -220,6 +222,9 @@
if ( !iterator->p )
{
+ FT_ULong offset;
+
+
/* first call to function */
iterator->layer = 0;
@@ -229,13 +234,16 @@
&glyph_record ) )
return 0;
- iterator->p = colr->layers +
- LAYER_SIZE * glyph_record.first_layer_index;
-
if ( glyph_record.num_layers )
iterator->num_layers = glyph_record.num_layers;
else
return 0;
+
+ offset = LAYER_SIZE * glyph_record.first_layer_index;
+ if ( offset + LAYER_SIZE * glyph_record.num_layers > colr->table_size )
+ return 0;
+
+ iterator->p = colr->layers + offset;
}
if ( iterator->layer >= iterator->num_layers )