[lzw] Avoid invalid left shift.

* src/lzw/ftzopen.c (ft_lzwstate_get_code): Limit `num_bits'.
9 years ago · 548f68d805
parent 8d7b9198e3
commit 548f68d805
2 changed files with 9 additions and 0 deletions
--- a/6
+++ b/6
@ -1,3 +1,9 @@
+2016-08-16  Werner Lemberg  <wl@gnu.org>
+
+	[lzw] Avoid invalid left shift.
+
+	* src/lzw/ftzopen.c (ft_lzwstate_get_code): Limit `num_bits'.
+
 2016-08-16  Werner Lemberg  <wl@gnu.org>

 	[lzw] Avoid buffer overrun.
--- a/src/lzw/ftzopen.c
+++ b/src/lzw/ftzopen.c
@ -65,6 +65,9 @@
    FT_Int    result;


+    if ( num_bits > LZW_MAX_BITS )
+      return -1;
+
    if ( state->buf_clear                    ||
         offset >= state->buf_size           ||
         state->free_ent >= state->free_bits )