walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[sbix] Check glyph data end is in range

This commit is contained in:
Behdad Esfahbod 2018-10-28 15:38:42 -07:00
parent b76dc03108
commit 0730d62385
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/hb-ot-color-sbix-table.hh
View File

@ -90,11 +90,13 @@ struct SBIXStrike
unsigned int retry_count = 8; unsigned int retry_count = 8;
unsigned int sbix_len = sbix_blob->length; unsigned int sbix_len = sbix_blob->length;
unsigned int strike_offset = (const char *) this - (const char *) sbix_blob->data; unsigned int strike_offset = (const char *) this - (const char *) sbix_blob->data;
assert (strike_offset < sbix_len);
retry: retry:
if (unlikely (glyph_id >= num_glyphs || if (unlikely (glyph_id >= num_glyphs ||
imageOffsetsZ[glyph_id + 1] < imageOffsetsZ[glyph_id] || imageOffsetsZ[glyph_id + 1] < imageOffsetsZ[glyph_id] ||
imageOffsetsZ[glyph_id + 1] - imageOffsetsZ[glyph_id] <= SBIXGlyph::min_size)) imageOffsetsZ[glyph_id + 1] - imageOffsetsZ[glyph_id] <= SBIXGlyph::min_size ||
(unsigned int) imageOffsetsZ[glyph_id + 1] > sbix_len - strike_offset))
return hb_blob_get_empty (); return hb_blob_get_empty ();
unsigned int glyph_offset = strike_offset + (unsigned int) imageOffsetsZ[glyph_id] + SBIXGlyph::min_size; unsigned int glyph_offset = strike_offset + (unsigned int) imageOffsetsZ[glyph_id] + SBIXGlyph::min_size;