general/freetype2
2
0
Fork 0
mirror of git://git.sv.nongnu.org/freetype/freetype2.git synced 2026-01-19 04:52:09 +00:00
Code Issues Projects Releases Wiki Activity

[ttgxvar] Check for overflow in array size computation.

Browse Source 
Problem reported and analyzed by povcfe <povcfe2sec@gmail.com>.

Fixes issue #1382.

* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Do it.
This commit is contained in:
Werner Lemberg
2026-01-03 08:07:57 +01:00
parent 23b6cd27ff
commit fc85a25584
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/truetype/ttgxvar.c
View File

@@ -628,6 +628,7 @@
FT_UShort word_delta_count;
FT_UInt region_idx_count;
FT_UInt per_region_size;
FT_UInt delta_set_size;
if ( FT_STREAM_SEEK( offset + dataOffsetArray[i] ) )
@@ -697,7 +698,19 @@
if ( long_words )
per_region_size *= 2;
if ( FT_NEW_ARRAY( varData->deltaSet, per_region_size * item_count ) )
/* Check for overflow (we actually test whether the */
/* multiplication of two unsigned values wraps around). */
delta_set_size = per_region_size * item_count;
if ( per_region_size &&
delta_set_size / per_region_size != item_count )
{
FT_TRACE2(( "tt_var_load_item_variation_store:"
" bad delta set array size\n" ));
error = FT_THROW( Array_Too_Large );
goto Exit;
}
if ( FT_NEW_ARRAY( varData->deltaSet, delta_set_size ) )
goto Exit;
if ( FT_Stream_Read( stream,
varData->deltaSet,