kc3-lang/freetype/src

• Show log

  Commit

• Hash : 335224be
  Author :
  Date : 2022-03-03T16:33:40
  

  [sfnt] Fix bounds check in SVG. The `SVG_DOCUMENT_LIST_MINIMUM_SIZE` macro is non trivial and not protected by parentheses. As a result, the expression `table_size - SVG_DOCUMENT_LIST_MINIMUM_SIZE` expands to `table_size - 2U + SVG_DOCUMENT_RECORD_SIZE` instead of the expected `table_size - (2U + SVG_DOCUMENT_RECORD_SIZE)`. This causes an incorrect bounds check which may lead to reading past the end of the `SVG ` table. * src/sfnt/ttsvg.c (tt_face_load_svg): wrap macro definitions in parentheses. Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45179

• Files

• autofit/
• base/
• bdf/
• bzip2/
• cache/
• cff/
• cid/
• dlg/
• gxvalid/
• gzip/
• lzw/
• otvalid/
• pcf/
• pfr/
• psaux/
• pshinter/
• psnames/
• raster/
• sdf/
• sfnt/
• smooth/
• svg/
• tools/
• truetype/
• type1/
• type42/
• winfonts/

• Properties

• Git HTTP	https://git.kmx.io/kc3-lang/freetype.git
  Git SSH	git@git.kmx.io:kc3-lang/freetype.git
  Public access ?	public
  Description	https://gitlab.freedesktop.org/freetype/freetype
  Users
  Tags