[Git][freetype/freetype][master] [truetype] Tweak `hdmx` checking.

[Alexei Podtelezhnikov (@apodtele)]

Alexei Podtelezhnikov pushed to branch master at FreeType / FreeType

Commits:

• 5b626281
  by Alexei Podtelezhnikov at 2021-09-10T10:19:07-04:00

  [truetype] Tweak `hdmx` checking.
  
  Fixes #1096.
  
  * src/truetype/ttpload.c (tt_face_load_hdmx): Account for padding.
  

1 changed file:

• src/truetype/ttpload.c

Changes:

src/truetype/ttpload.c

---

...	...	@@ -548,8 +548,8 @@
548	548	record_size = FT_NEXT_ULONG( p );
549	549
550	550	/* The maximum number of bytes in an hdmx device record is the */
551		- /* maximum number of glyphs + 2; this is 0xFFFF + 2, thus */
552		- /* explaining why `record_size' is a long (which we read as */
	551	+ /* maximum number of glyphs + 2 + 32-bit padding, or 0x10004, */
	552	+ /* that is why `record_size' is a long (which we read as */
553	553	/* unsigned long for convenience). In practice, two bytes are */
554	554	/* sufficient to hold the size value. */
555	555	/* */
...	...	@@ -562,10 +562,10 @@
562	562	record_size &= 0xFFFFU;
563	563
564	564	/* The limit for `num_records' is a heuristic value. */
565		- if ( num_records > 255 ||
566		- ( num_records > 0 &&
567		- ( record_size > 0x10001L ||
568		- record_size < 4 ) ) )
	565	+ if ( num_records > 255 ||
	566	+ ( num_records > 0 &&
	567	+ ( record_size > 0x10004UL ||
	568	+ record_size & 3 ) ) )
569	569	{
570	570	error = FT_THROW( Invalid_File_Format );
571	571	goto Fail;

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.