From 4facaae3de37c920d692814269c1d8cba893fb8d Mon Sep 17 00:00:00 2001 From: Khaled Hosny Date: Sun, 27 Jul 2014 23:04:57 +0000 Subject: Avoid read past 65536 glyphs git-svn-id: svn://tug.org/texlive/trunk@34745 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipdfm-x/ChangeLog | 2 ++ Build/source/texk/dvipdfm-x/cff.c | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) (limited to 'Build/source/texk/dvipdfm-x') diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog index 14e55b48ace..7fdca03d6f7 100644 --- a/Build/source/texk/dvipdfm-x/ChangeLog +++ b/Build/source/texk/dvipdfm-x/ChangeLog @@ -6,6 +6,8 @@ * pdfdev.c, pdffont.c, pdffont.h, tt_cmap.c, type0.c, type0.h: Fix reverse CMap lookup for ToUnicode map generation. + * cff.c: Avoid read past 65536 glyphs. + 2014-07-26 Peter Breitenlohner * dpxfile.c: Add a default case to avoid compiler warnings. diff --git a/Build/source/texk/dvipdfm-x/cff.c b/Build/source/texk/dvipdfm-x/cff.c index b576a8b4f0f..7dd35d44cb0 100644 --- a/Build/source/texk/dvipdfm-x/cff.c +++ b/Build/source/texk/dvipdfm-x/cff.c @@ -301,9 +301,13 @@ cff_get_index_header (cff_font *cff) ERROR("invalid offsize data"); idx->offset = NEW(count+1, l_offset); - for (i=0;ioffset)[i] = get_offset(cff->stream, idx->offsize); } + if (count == 0xFFFF) + cff_seek(cff, cff_tell(cff) + idx->offsize); + else + (idx->offset)[i] = get_offset(cff->stream, idx->offsize); if (idx->offset[0] != 1) ERROR("cff_get_index(): invalid index data"); -- cgit v1.2.3