Commit a764963f267b5e253a0a48fefd10efdb0b20c5b9
2016-09-25T16:29:05
[truetype] Sanitize only last entry of `loca' table. Without this patch, a loca sequence like `0 100000 0 100000 ...', where value 100000 is larger than the `glyf' table size, makes FreeType handle the whole `glyf' table as a single glyph again and again, which is certainly invalid (and can be very slow, too). * src/truetype/ttpload.c (tt_face_get_location): Implement. Improve tracing messages.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
diff --git a/ChangeLog b/ChangeLog
index f9be16e..04b2d54 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
2016-09-25 Werner Lemberg <wl@gnu.org>
+ [truetype] Sanitize only last entry of `loca' table.
+
+ Without this patch, a loca sequence like `0 100000 0 100000 ...',
+ where value 100000 is larger than the `glyf' table size, makes
+ FreeType handle the whole `glyf' table as a single glyph again and
+ again, which is certainly invalid (and can be very slow, too).
+
+ * src/truetype/ttpload.c (tt_face_get_location): Implement.
+ Improve tracing messages.
+
+2016-09-25 Werner Lemberg <wl@gnu.org>
+
* src/tools/ftfuzzer/ftfuzzer.cc (LLVMFuzzerTestOneInput): Fix typo.
2016-09-24 Werner Lemberg <wl@gnu.org>
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c
index ca158ac..328f3a3 100644
--- a/src/truetype/ttpload.c
+++ b/src/truetype/ttpload.c
@@ -222,13 +222,13 @@
}
}
- /* Check broken location data */
+ /* Check broken location data. */
if ( pos1 > face->glyf_len )
{
FT_TRACE1(( "tt_face_get_location:"
- " too large offset=0x%08lx found for gid=0x%04lx,\n"
+ " too large offset (0x%08lx) found for glyph index %ld,\n"
" "
- " exceeding the end of glyf table (0x%08lx)\n",
+ " exceeding the end of `glyf' table (0x%08lx)\n",
pos1, gindex, face->glyf_len ));
*asize = 0;
return 0;
@@ -236,12 +236,26 @@
if ( pos2 > face->glyf_len )
{
- FT_TRACE1(( "tt_face_get_location:"
- " too large offset=0x%08lx found for gid=0x%04lx,\n"
- " "
- " truncate at the end of glyf table (0x%08lx)\n",
- pos2, gindex + 1, face->glyf_len ));
- pos2 = face->glyf_len;
+ /* We try to sanitize the last `loca' entry. */
+ if ( gindex == face->num_locations - 1 )
+ {
+ FT_TRACE1(( "tt_face_get_location:"
+ " too large offset (0x%08lx) found for glyph index %ld,\n"
+ " "
+ " truncating at the end of `glyf' table (0x%08lx)\n",
+ pos2, gindex + 1, face->glyf_len ));
+ pos2 = face->glyf_len;
+ }
+ else
+ {
+ FT_TRACE1(( "tt_face_get_location:"
+ " too large offset (0x%08lx) found for glyph index %ld,\n"
+ " "
+ " exceeding the end of `glyf' table (0x%08lx)\n",
+ pos2, gindex + 1, face->glyf_len ));
+ *asize = 0;
+ return 0;
+ }
}
/* The `loca' table must be ordered; it refers to the length of */