[type1]: Improve guard against malformed data. Based on a patch submitted by Johnson Y. Yan <yinsen_yan@foxitsoftware.com> * src/type1/t1load.c (read_binary_data): Check `size'.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
diff --git a/ChangeLog b/ChangeLog
index 49dfa75..4b4988e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010-11-18 Werner Lemberg <wl@gnu.org>
+
+ [type1]: Improve guard against malformed data.
+ Based on a patch submitted by Johnson Y. Yan
+ <yinsen_yan@foxitsoftware.com>
+
+ * src/type1/t1load.c (read_binary_data): Check `size'.
+
2010-11-17 Werner Lemberg <wl@gnu.org>
[sfnt] While tracing, output table checksums also.
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 079f339..c7701c7 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -4,7 +4,8 @@
/* */
/* Type 1 font loader (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, */
+/* 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -1045,7 +1046,8 @@
if ( cur < limit && ft_isdigit( *cur ) )
{
- *size = T1_ToInt( parser );
+ FT_Long s = T1_ToInt( parser );
+
T1_Skip_PS_Token( parser ); /* `RD' or `-|' or something else */
@@ -1053,8 +1055,12 @@
/* `RD' or `-|' token */
*base = parser->root.cursor + 1;
- parser->root.cursor += *size + 1;
- return !parser->root.error;
+ if ( s >= 0 && s < limit - *base )
+ {
+ parser->root.cursor += s + 1;
+ *size = s;
+ return !parser->root.error;
+ }
}
FT_ERROR(( "read_binary_data: invalid size field\n" ));