[sfnt] Fix Savannah bug #43589.

* src/sfnt/sfobjs.c (woff_open_font): Protect against addition overflow.
10 years ago · f46add1389
parent 602040b111
commit f46add1389
2 changed files with 11 additions and 2 deletions
--- a/7
+++ b/7
@ -1,3 +1,10 @@
+2014-11-12  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt] Fix Savannah bug #43589.
+
+	* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
+	overflow.
+
 2014-11-12  Werner Lemberg  <wl@gnu.org>

 	[sfnt] Fix Savannah bug #43588.
--- a/src/sfnt/sfobjs.c
+++ b/src/sfnt/sfobjs.c
@ -567,8 +567,10 @@


      if ( table->Offset != woff_offset                         ||
-           table->Offset + table->CompLength > woff.length      ||
-           sfnt_offset + table->OrigLength > woff.totalSfntSize ||
+           table->CompLength > woff.length                      ||
+           table->Offset > woff.length - table->CompLength      ||
+           table->OrigLength > woff.totalSfntSize               ||
+           sfnt_offset > woff.totalSfntSize - table->OrigLength ||
           table->CompLength > table->OrigLength                )
      {
        error = FT_THROW( Invalid_Table );