* src/truetype/ttgxvar.c (TT_Get_MM_Var): Check axis data.

Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=348
8 years ago · 91fc3bd7c9
parent 180185109b
commit 91fc3bd7c9
2 changed files with 19 additions and 0 deletions
--- a/8
+++ b/8
@ -1,3 +1,11 @@
+2016-12-29  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgxvar.c (TT_Get_MM_Var): Check axis data.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=348
+
 2016-12-29  Werner Lemberg  <wl@gnu.org>

 	[truetype] Tracing fixes.
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@ -1435,6 +1435,17 @@
        a->name[3] = (FT_String)( ( a->tag       ) & 0xFF );
        a->name[4] = '\0';

+        if ( a->minimum > a->def ||
+             a->def > a->maximum )
+        {
+          FT_TRACE2(( "TT_Get_MM_Var:"
+                      " invalid \"%s\" axis record; disabling\n",
+                      a->name ));
+
+          a->minimum = a->def;
+          a->maximum = a->def;
+        }
+
        FT_TRACE5(( "  \"%s\": minimum=%.5f, default=%.5f, maximum=%.5f\n",
                    a->name,
                    a->minimum / 65536.0,