-
Browse
Commit
-
Author :
Dominik Röttsches
Date :
2022-09-27 17:50:55
Hash :
df260139
Message :
[sfnt] Guard access in 'COLR' table when requesting child table pointer.
* src/sfnt/ttcolr.c (tt_face_get_colorline_stops, read_paint): Tighten
pointer bounds checks.
(get_child_table_pointer): Check whether incoming pointer `p` lies within
the 'COLR' table.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51816