From 2550fc75a56f18aff2a6543a1ad07724b5f97767 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 18 Aug 2018 13:38:48 +0200 Subject: [PATCH] [cff] Fix heap buffer overflow in old engine. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be non-zero. --- ChangeLog | 12 ++++++++++++ src/psaux/cffdecode.c | 3 +++ 2 files changed, 15 insertions(+) diff --git a/ChangeLog b/ChangeLog index e2dd62161..4e30cdcd2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2018-08-14 Werner Lemberg + + [cff] Fix heap buffer overflow in old engine. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9967 + + * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) + [CFF_CONFIG_OPTION_OLD_ENGINE]: `num_designs' must be + non-zero. + 2018-08-16 Young Xiao * builds/mac/ftmac.c (parse_fond): Fix buffer overrun. diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index 5732beb8a..3f4cfd42b 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -1935,6 +1935,7 @@ case cff_op_blend: /* this operator was removed from the Type2 specification */ /* in version 16-March-2000 */ + if ( num_designs ) { FT_Int num_results = (FT_Int)( args[0] >> 16 ); @@ -1953,6 +1954,8 @@ args -= num_results * ( num_designs - 1 ); num_args -= num_results * ( num_designs - 1 ); } + else + goto Syntax_Error; break; case cff_op_dotsection: