summaryrefslogtreecommitdiff
path: root/Build/source/libs/freetype2/freetype-src/src/sfnt
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2023-08-25 23:10:40 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2023-08-25 23:10:40 +0000
commit9e08f7eb34e5cdfcc30c12d25f4e9677e3f38843 (patch)
treee9e089386b6eda59d12684ff08882a96b82003dc /Build/source/libs/freetype2/freetype-src/src/sfnt
parent44d323c1121857a0f7a01e018119ea8e923db84f (diff)
freetype 2.13.2
git-svn-id: svn://tug.org/texlive/trunk@68062 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/sfnt')
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c18
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c4
2 files changed, 14 insertions, 8 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c b/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c
index 49ad5cc8114..2be44a347ad 100644
--- a/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c
+++ b/Build/source/libs/freetype2/freetype-src/src/sfnt/sfwoff2.c
@@ -36,6 +36,8 @@
#undef FT_COMPONENT
#define FT_COMPONENT sfwoff2
+ /* An arbitrary, heuristic size limit (67MByte) for expanded WOFF2 data. */
+#define MAX_SFNT_SIZE ( 1 << 26 )
#define READ_255USHORT( var ) FT_SET_ERROR( Read255UShort( stream, &var ) )
@@ -2180,9 +2182,8 @@
else
sfnt_size = woff2.totalSfntSize;
- /* Value 1<<26 = 67108864 is heuristic. */
- if (sfnt_size >= (1 << 26))
- sfnt_size = 1 << 26;
+ if ( sfnt_size >= MAX_SFNT_SIZE )
+ sfnt_size = MAX_SFNT_SIZE;
#ifdef FT_DEBUG_LEVEL_TRACE
if ( sfnt_size != woff2.totalSfntSize )
@@ -2257,10 +2258,15 @@
goto Exit;
}
- if ( woff2.uncompressed_size > sfnt_size )
+ /* We must not blindly trust `uncompressed_size` since its */
+ /* value might be corrupted. If it is too large, reject the */
+ /* font. In other words, we don't accept a WOFF2 font that */
+ /* expands to something larger than MAX_SFNT_SIZE. If ever */
+ /* necessary, this limit can be easily adjusted. */
+ if ( woff2.uncompressed_size > MAX_SFNT_SIZE )
{
- FT_ERROR(( "woff2_open_font: SFNT table lengths are too large.\n" ));
- error = FT_THROW( Invalid_Table );
+ FT_ERROR(( "Uncompressed font too large.\n" ));
+ error = FT_THROW( Array_Too_Large );
goto Exit;
}
diff --git a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c
index 69ccf0ee7ae..281e7135eea 100644
--- a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c
+++ b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttcolr.c
@@ -229,7 +229,7 @@
base_glyphs_offset_v1 = FT_NEXT_ULONG( p );
- if ( base_glyphs_offset_v1 + 4 >= table_size )
+ if ( base_glyphs_offset_v1 >= table_size - 4 )
goto InvalidTable;
p1 = (FT_Byte*)( table + base_glyphs_offset_v1 );
@@ -249,7 +249,7 @@
if ( layer_offset_v1 )
{
- if ( layer_offset_v1 + 4 >= table_size )
+ if ( layer_offset_v1 >= table_size - 4 )
goto InvalidTable;
p1 = (FT_Byte*)( table + layer_offset_v1 );