[Git][freetype/freetype][master] [sfnt] Pointer sanity checks before reading layer info in 'COLR' v0

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 6d62076a
  by Dominik Röttsches at 2022-09-05T12:23:31+02:00

  [sfnt] Pointer sanity checks before reading layer info in 'COLR' v0
  
  * src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to
  read from is within the 'COLR' table.
  
  Reported as
  
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633
  

1 changed file:

• src/sfnt/ttcolr.c

Changes:

src/sfnt/ttcolr.c

---

...	...	@@ -481,7 +481,9 @@
481	481	iterator->p = colr->layers + offset;
482	482	}
483	483
484		- if ( iterator->layer >= iterator->num_layers )
	484	+ if ( iterator->layer >= iterator->num_layers ||
	485	+ iterator->p < colr->layers ||
	486	+ iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) )
485	487	return 0;
486	488
487	489	*aglyph_index = FT_NEXT_USHORT( iterator->p );

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. Manage all notifications · Help