[truetype] Check axis count in HVAR table.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362

* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
(ft_var_load_avar): Fix tracing message.

ChangeLog

@@ -1,4 +1,15 @@
-2016-09-08  Werner Lemberg  <wl@gnu.org>
+2016-12-31  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Check axis count in HVAR table.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=362
+
+	* src/truetype/ttgxvar.c (ft_var_load_hvar): Check axis count.
+	(ft_var_load_avar): Fix tracing message.
+
+2016-12-30  Werner Lemberg  <wl@gnu.org>
 
 	* Version 2.7.1 released.
 	=========================

src/truetype/ttgxvar.c

@@ -346,7 +346,7 @@
 
     if ( axisCount != (FT_Long)blend->mmvar->num_axis )
     {
-      FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `cvar'\n"
+      FT_TRACE2(( "ft_var_load_avar: number of axes in `avar' and `fvar'\n"
                   "                  table are different\n" ));
       goto Exit;
     }
@@ -521,6 +521,14 @@
            FT_READ_USHORT( itemStore->regionCount ) )
         goto Exit;
 
+      if ( itemStore->axisCount != (FT_Long)blend->mmvar->num_axis )
+      {
+        FT_TRACE2(( "ft_var_load_hvar: number of axes in `hvar' and `fvar'\n"
+                    "                  table are different\n" ));
+        error = FT_THROW( Invalid_Table );
+        goto Exit;
+      }
+
       if ( FT_NEW_ARRAY( itemStore->varRegionList, itemStore->regionCount ) )
         goto Exit;