Commit f0cc1738e2914851ab50c0fe121e45f40f7f95d6
2015-12-14T07:00:41
[base] Check error when seeking to data supplied offset (#46635). * src/base/ftobjs.c (open_face_PS_from_sfnt_stream): `ft_lookup_PS_in_sfnt_stream' returns offset and and length from user supplied data. Use of this these values must be checked.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66
diff --git a/ChangeLog b/ChangeLog
index db29a80..1c7c3c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2015-12-10 Ben Wagner <bungeman@gmail.com>
+
+ [base] Check error when seeking to data supplied offset (#46635).
+
+ * src/base/ftobjs.c (open_face_PS_from_sfnt_stream):
+ `ft_lookup_PS_in_sfnt_stream' returns offset and and length from
+ user supplied data. Use of this these values must be checked.
+
2015-12-13 Werner Lemberg <wl@gnu.org>
[autofit] Add support for Myanmar script.
@@ -551,7 +559,7 @@
Handle them.
(af_autofitter_init): Initialize them.
-2015-11-02 Bungeman <bungeman@gmail.com>
+2015-11-02 Ben Wagner <bungeman@gmail.com>
[ftfuzzer] Add support for multiple files (patch #8779).
@@ -759,7 +767,7 @@
* src/type1/t1afm.c (T1_Read_Metrics): Fix memory leak (#46229).
-2015-10-19 Bungeman <bungeman@gmail.com>
+2015-10-19 Ben Wagner <bungeman@gmail.com>
[cid] Better handle invalid glyph stream offsets (#46221).
@@ -837,7 +845,7 @@
* src/tools/ftfuzzer/README: New file.
-2015-10-15 Bungeman <bungeman@gmail.com>
+2015-10-15 Ben Wagner <bungeman@gmail.com>
[bdf] Fix memory leak (#46213).
@@ -860,7 +868,7 @@
The used indices were off by 1.
-2015-10-15 Bungeman <bungeman@gmail.com>
+2015-10-15 Ben Wagner <bungeman@gmail.com>
Werner Lemberg <wl@gnu.org>
* src/tools/ftfuzzer/ftfuzzer.cc: Handle fixed sizes (#46211).
diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index ea40396..58ff091 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1521,7 +1521,8 @@
if ( error )
goto Exit;
- if ( FT_Stream_Seek( stream, pos + offset ) )
+ error = FT_Stream_Seek( stream, pos + offset );
+ if ( error )
goto Exit;
if ( FT_ALLOC( sfnt_ps, (FT_Long)length ) )