walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[ot-font] Fix hmtx wrong table length check 

Discovered by libFuzzer.  Ouch!

https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
This commit is contained in:
Behdad Esfahbod 2015-10-15 12:47:22 -03:00
parent 613e630617
commit 63ef0b41dc
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/hb-ot-font.cc
View File

@ -59,7 +59,7 @@ struct hb_ot_face_metrics_accelerator_t
this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag)); this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag));
if (unlikely (!this->num_advances || if (unlikely (!this->num_advances ||
2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob))) 2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
{ {
this->num_metrics = this->num_advances = 0; this->num_metrics = this->num_advances = 0;
hb_blob_destroy (this->blob); hb_blob_destroy (this->blob);