From 5b86f53dd60c7545dcea75684561199ac3d3e90f Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Tue, 6 Nov 2018 11:08:41 +0100 Subject: [PATCH] [psaux] Fix timeout in old CFF engine. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11260 * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix potential endless loop. --- ChangeLog | 12 ++++++++++++ src/psaux/cffdecode.c | 5 ++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 89df20844..3b73bac6a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2018-11-06 Werner Lemberg + + [psaux] Fix timeout in old CFF engine. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11260 + + * src/psaux/cffdecode.c (cff_decoder_parse_charstrings) + [CFF_CONFIG_OPTION_OLD_ENGINE]: Fix potential endless + loop. + 2018-11-04 Alexei Podtelezhnikov * src/truetype/ttgxvar.c: Use enum definitions. diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c index ac1bc1fe2..09a77cd3c 100644 --- a/src/psaux/cffdecode.c +++ b/src/psaux/cffdecode.c @@ -1748,7 +1748,10 @@ case cff_op_sqrt: FT_TRACE4(( " sqrt\n" )); - if ( args[0] > 0 ) + /* without upper limit the loop below might not finish */ + if ( args[0] > 0x7FFFFFFFL ) + args[0] = 46341; + else if ( args[0] > 0 ) { FT_Fixed root = args[0]; FT_Fixed new_root;