Adjust table size comparisons (#54242).

* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
7 years ago · 0767d5362f
parent 6ceeb87f5d
commit 0767d5362f
2 changed files with 13 additions and 1 deletions
--- a/6
+++ b/6
@ -1,3 +1,9 @@
+2018-07-05  Werner Lemberg  <wl@gnu.org>
+
+	Adjust table size comparisons (#54242).
+
+	* src/sfnt/ttcpal.c (tt_face_load_cpal): Implement it.
+
 2018-07-05  Werner Lemberg  <wl@gnu.org>

 	Fix more 32bit issues (#54208)
--- a/src/sfnt/ttcpal.c
+++ b/src/sfnt/ttcpal.c
@ -112,6 +112,10 @@
    cpal->num_colors = FT_NEXT_USHORT( p );
    colors_offset    = FT_NEXT_ULONG( p );

+    if ( CPAL_V0_HEADER_BASE_SIZE             +
+         face->palette_data.num_palettes * 2U > table_size )
+      goto InvalidTable;
+
    if ( colors_offset >= table_size )
      goto InvalidTable;
    if ( cpal->num_colors * COLOR_SIZE > table_size - colors_offset )
@ -128,7 +132,9 @@
      FT_UShort*  q;


-      if ( face->palette_data.num_palettes * 2 + 3U * 4 > table_size )
+      if ( CPAL_V0_HEADER_BASE_SIZE             +
+           face->palette_data.num_palettes * 2U +
+           3U * 4                               > table_size )
        goto InvalidTable;

      p += face->palette_data.num_palettes * 2;