Commit f958c48ee431bef8d4d466b40c9cb2d4dbcb7791
2017-03-24T09:15:10
[psaux] Better protect `flex' handling. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 * src/psaux/t1decode.c (t1_decoder_parse_charstrings) <callothersubr>: Since there is not a single flex operator but a series of subroutine calls, malformed fonts can call arbitrary other operators after the start of a flex, possibly adding points. For this reason we have to check the available number of points before inserting a point.