Commit a115142057f98104cbe745be9ed9175fd7357e43
2009-08-01T00:32:18
truetype: Check invalid function number in IDEF instruction.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
diff --git a/ChangeLog b/ChangeLog
index 9696b52..6591003 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+ truetype: Check invalid function number in IDEF instruction.
+
+ * src/truetype/ttinterp.c (Ins_IDEF): Check
+ if the operand fits to 8-bit opcode limitation.
+
+2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
truetype: Check invalid function number in FDEF instruction.
* src/truetype/ttinterp.c (Ins_FDEF): Check
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 816d1da..13aa9a2 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -4561,13 +4561,20 @@
CUR.numIDefs++;
}
- def->opc = args[0];
+ /* opcode must be unsigned 8-bit integer */
+ if ( 0 > args[0] || args[0] > 0x00FF )
+ {
+ CUR.error = TT_Err_Too_Many_Instruction_Defs;
+ return;
+ }
+
+ def->opc = (FT_Byte)args[0];
def->start = CUR.IP+1;
def->range = CUR.curRange;
def->active = TRUE;
if ( (FT_ULong)args[0] > CUR.maxIns )
- CUR.maxIns = args[0];
+ CUR.maxIns = (FT_Byte)args[0];
/* Now skip the whole function definition. */
/* We don't allow nested IDEFs & FDEFs. */