diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2023-08-25 23:10:40 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2023-08-25 23:10:40 +0000 |
commit | 9e08f7eb34e5cdfcc30c12d25f4e9677e3f38843 (patch) | |
tree | e9e089386b6eda59d12684ff08882a96b82003dc /Build/source/libs/freetype2/freetype-src/src/sfnt | |
parent | 44d323c1121857a0f7a01e018119ea8e923db84f (diff) |
freetype 2.13.2
git-svn-id: svn://tug.org/texlive/trunk@68062 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/sfnt')
-rw-r--r-- | Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c | 18 | ||||
-rw-r--r-- | Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c | 4 |
2 files changed, 14 insertions, 8 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c b/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c index 49ad5cc8114..2be44a347ad 100644 --- a/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c +++ b/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c @@ -36,6 +36,8 @@ #undef FT_COMPONENT #define FT_COMPONENT sfwoff2 + /* An arbitrary, heuristic size limit (67MByte) for expanded WOFF2 data. */ +#define MAX_SFNT_SIZE ( 1 << 26 ) #define READ_255USHORT( var ) FT_SET_ERROR( Read255UShort( stream, &var ) ) @@ -2180,9 +2182,8 @@ else sfnt_size = woff2.totalSfntSize; - /* Value 1<<26 = 67108864 is heuristic. */ - if (sfnt_size >= (1 << 26)) - sfnt_size = 1 << 26; + if ( sfnt_size >= MAX_SFNT_SIZE ) + sfnt_size = MAX_SFNT_SIZE; #ifdef FT_DEBUG_LEVEL_TRACE if ( sfnt_size != woff2.totalSfntSize ) @@ -2257,10 +2258,15 @@ goto Exit; } - if ( woff2.uncompressed_size > sfnt_size ) + /* We must not blindly trust `uncompressed_size` since its */ + /* value might be corrupted. If it is too large, reject the */ + /* font. In other words, we don't accept a WOFF2 font that */ + /* expands to something larger than MAX_SFNT_SIZE. If ever */ + /* necessary, this limit can be easily adjusted. */ + if ( woff2.uncompressed_size > MAX_SFNT_SIZE ) { - FT_ERROR(( "woff2_open_font: SFNT table lengths are too large.\n" )); - error = FT_THROW( Invalid_Table ); + FT_ERROR(( "Uncompressed font too large.\n" )); + error = FT_THROW( Array_Too_Large ); goto Exit; } diff --git a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c index 69ccf0ee7ae..281e7135eea 100644 --- a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c +++ b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c @@ -229,7 +229,7 @@ base_glyphs_offset_v1 = FT_NEXT_ULONG( p ); - if ( base_glyphs_offset_v1 + 4 >= table_size ) + if ( base_glyphs_offset_v1 >= table_size - 4 ) goto InvalidTable; p1 = (FT_Byte*)( table + base_glyphs_offset_v1 ); @@ -249,7 +249,7 @@ if ( layer_offset_v1 ) { - if ( layer_offset_v1 + 4 >= table_size ) + if ( layer_offset_v1 >= table_size - 4 ) goto InvalidTable; p1 = (FT_Byte*)( table + layer_offset_v1 ); |