* src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.

Problem reported by Dennis Felsing <dennis@felsin9.de>.

ChangeLog

@@ -1,3 +1,9 @@
+2014-12-11  Werner Lemberg  <wl@gnu.org>
+
+	* src/type42/t42parse.c (t42_parse_sfnts): Check `string_size'.
+
+	Problem reported by Dennis Felsing <dennis@felsin9.de>.
+
 2014-12-09  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
 	[gxvalid] Fix a naming convention conflicting with ftvalid.

src/type42/t42parse.c

@@ -580,6 +580,12 @@
 
         /* don't include delimiters */
         string_size = (FT_Long)( ( parser->root.cursor - cur - 2 + 1 ) / 2 );
+        if ( !string_size )
+        {
+          FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" ));
+          error = FT_THROW( Invalid_File_Format );
+          goto Fail;
+        }
         if ( FT_REALLOC( string_buf, old_string_size, string_size ) )
           goto Fail;