diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2010-11-06 16:46:58 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2010-11-06 16:46:58 +0000 |
| commit | 673ab472b2b2fc30de90c1bc0a330257eb83dfa3 (patch) | |
| tree | d5ab678734a3daab88c6e323aff494c4bf507e27 | |
| parent | c572180aeb6016c74a4dd20ea121e4d26b0a2826 (diff) | |
Security MFC for CVE-2010-3855
commit 59eb9f8cfe7d1df379a2318316d1f04f80fba54a
Author: Werner Lemberg <wl@gnu.org>
Date: Tue Oct 12 07:49:17 2010 +0200
Fix Savannah bug #31310.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against
invalid `runcnt' values.
| -rw-r--r-- | lib/freetype/src/truetype/ttgxvar.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/freetype/src/truetype/ttgxvar.c b/lib/freetype/src/truetype/ttgxvar.c index 653d9d5cf..47bb9fcca 100644 --- a/lib/freetype/src/truetype/ttgxvar.c +++ b/lib/freetype/src/truetype/ttgxvar.c @@ -130,7 +130,7 @@ FT_Int j; FT_Int first; FT_Memory memory = stream->memory; - FT_Error error = TT_Err_Ok; + FT_Error error = TT_Err_Ok; FT_UNUSED( error ); @@ -154,7 +154,7 @@ runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; first = points[i++] = FT_GET_USHORT(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; /* first point not included in runcount */ @@ -165,7 +165,7 @@ { first = points[i++] = FT_GET_BYTE(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; for ( j = 0; j < runcnt; ++j ) |