Commit e97cb9e8da39673caeadf4b99a3aa1fb9e4c7301
2022-11-09T15:42:25
[truetype] Improve bounds checks for `ItemVariationStore`. * src/truetype/ttgxvar.c (tt_hvadvance_adjust): Move bounds check ... (tt_var_get_item_delta): ... to this function, because it is safer. For example, the 'avar' table 2.0 codepath was not performing a bounds check at all.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index f9960c0..458b958 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -996,10 +996,16 @@
/* See pseudo code from `Font Variations Overview' */
/* in the OpenType specification. */
+ if ( outerIndex >= itemStore->dataCount )
+ return 0; /* Out of range. */
+
varData = &itemStore->varData[outerIndex];
deltaSet = FT_OFFSET( varData->deltaSet,
varData->regionIdxCount * innerIndex );
+ if ( innerIndex >= varData->itemCount )
+ return 0; /* Out of range. */
+
if ( FT_QNEW_ARRAY( scalars, varData->regionIdxCount ) )
return 0;
@@ -1171,20 +1177,9 @@
}
else
{
- GX_ItemVarData varData;
-
-
/* no widthMap data */
outerIndex = 0;
innerIndex = gindex;
-
- varData = &table->itemStore.varData[outerIndex];
- if ( gindex >= varData->itemCount )
- {
- FT_TRACE2(( "gindex %d out of range\n", gindex ));
- error = FT_THROW( Invalid_Argument );
- goto Exit;
- }
}
delta = tt_var_get_item_delta( face,