1
From f46add13895337ece929b18bb8f036431b3fb538 Mon Sep 17 00:00:00 2001
2
From: Werner Lemberg <wl@gnu.org>
3
Date: Wed, 12 Nov 2014 20:06:08 +0000
4
Subject: [sfnt] Fix Savannah bug #43589.
6
* src/sfnt/sfobjs.c (woff_open_font): Protect against addition
9
Index: freetype-2.5.2/src/sfnt/sfobjs.c
10
===================================================================
11
--- freetype-2.5.2.orig/src/sfnt/sfobjs.c 2015-02-24 08:26:40.400011124 -0500
12
+++ freetype-2.5.2/src/sfnt/sfobjs.c 2015-02-24 08:26:40.392011070 -0500
16
if ( table->Offset != woff_offset ||
17
- table->Offset + table->CompLength > woff.length ||
18
- sfnt_offset + table->OrigLength > woff.totalSfntSize ||
19
+ table->CompLength > woff.length ||
20
+ table->Offset > woff.length - table->CompLength ||
21
+ table->OrigLength > woff.totalSfntSize ||
22
+ sfnt_offset > woff.totalSfntSize - table->OrigLength ||
23
table->CompLength > table->OrigLength )
25
error = FT_THROW( Invalid_Table );