Another left-shift bug (#45681).

* src/base/ftobjs.c (IsMacBinary): Only accept positive values for `dlen'.
10 years ago · eb22ef26d9
parent 7e6c321a58
commit eb22ef26d9
2 changed files with 15 additions and 7 deletions
--- a/7
+++ b/7
@ -1,3 +1,10 @@
+2015-08-04  Werner Lemberg  <wl@gnu.org>
+
+	Another left-shift bug (#45681).
+
+	* src/base/ftobjs.c (IsMacBinary): Only accept positive values for
+	`dlen'.
+
 2015-08-03  Alexei Podtelezhnikov  <apodtele@gmail.com>

 	[base] Fix `ft_corner_orientation'.
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@ -1889,13 +1889,14 @@
    if ( error )
      goto Exit;

-    if (            header[ 0] !=  0 ||
-                    header[74] !=  0 ||
-                    header[82] !=  0 ||
-                    header[ 1] ==  0 ||
-                    header[ 1] >  33 ||
-                    header[63] !=  0 ||
-         header[2 + header[1]] !=  0 )
+    if (            header[ 0] !=   0 ||
+                    header[74] !=   0 ||
+                    header[82] !=   0 ||
+                    header[ 1] ==   0 ||
+                    header[ 1] >   33 ||
+                    header[63] !=   0 ||
+         header[2 + header[1]] !=   0 ||
+                  header[0x53] > 0x7F )
      return FT_THROW( Unknown_File_Format );

    dlen = ( header[0x53] << 24 ) |