Blame freetype-2.5.0-CVE-2014-2241.patch
|
|
77f1177 |
From 135c3faebb96f8f550bd4f318716f2e1e095a969 Mon Sep 17 00:00:00 2001
|
|
|
77f1177 |
From: Dave Arnold <darnold@adobe.com>
|
|
|
77f1177 |
Date: Fri, 28 Feb 2014 06:42:42 +0000
|
|
|
77f1177 |
Subject: Fix Savannah bug #41697, part 2.
|
|
|
77f1177 |
|
|
|
77f1177 |
* src/cff/cf2ft.c (cf2_initLocalRegionBuffer,
|
|
|
77f1177 |
cf2_initGlobalRegionBuffer): It is possible for a charstring to call
|
|
|
77f1177 |
a subroutine if no subroutines exist. This is an error but should
|
|
|
77f1177 |
not trigger an assert. Split the assert to account for this.
|
|
|
77f1177 |
---
|
|
|
77f1177 |
diff --git a/src/cff/cf2ft.c b/src/cff/cf2ft.c
|
|
|
77f1177 |
index df5f8fb..82bac75 100644
|
|
|
77f1177 |
--- a/src/cff/cf2ft.c
|
|
|
77f1177 |
+++ b/src/cff/cf2ft.c
|
|
|
77f1177 |
@@ -521,7 +521,7 @@
|
|
|
77f1177 |
CF2_UInt idx,
|
|
|
77f1177 |
CF2_Buffer buf )
|
|
|
77f1177 |
{
|
|
|
77f1177 |
- FT_ASSERT( decoder && decoder->globals );
|
|
|
77f1177 |
+ FT_ASSERT( decoder );
|
|
|
77f1177 |
|
|
|
77f1177 |
FT_ZERO( buf );
|
|
|
77f1177 |
|
|
|
77f1177 |
@@ -529,6 +529,8 @@
|
|
|
77f1177 |
if ( idx >= decoder->num_globals )
|
|
|
77f1177 |
return TRUE; /* error */
|
|
|
77f1177 |
|
|
|
77f1177 |
+ FT_ASSERT( decoder->globals );
|
|
|
77f1177 |
+
|
|
|
77f1177 |
buf->start =
|
|
|
77f1177 |
buf->ptr = decoder->globals[idx];
|
|
|
77f1177 |
buf->end = decoder->globals[idx + 1];
|
|
|
77f1177 |
@@ -594,7 +596,7 @@
|
|
|
77f1177 |
CF2_UInt idx,
|
|
|
77f1177 |
CF2_Buffer buf )
|
|
|
77f1177 |
{
|
|
|
77f1177 |
- FT_ASSERT( decoder && decoder->locals );
|
|
|
77f1177 |
+ FT_ASSERT( decoder );
|
|
|
77f1177 |
|
|
|
77f1177 |
FT_ZERO( buf );
|
|
|
77f1177 |
|
|
|
77f1177 |
@@ -602,6 +604,8 @@
|
|
|
77f1177 |
if ( idx >= decoder->num_locals )
|
|
|
77f1177 |
return TRUE; /* error */
|
|
|
77f1177 |
|
|
|
77f1177 |
+ FT_ASSERT( decoder->locals );
|
|
|
77f1177 |
+
|
|
|
77f1177 |
buf->start =
|
|
|
77f1177 |
buf->ptr = decoder->locals[idx];
|
|
|
77f1177 |
buf->end = decoder->locals[idx + 1];
|
|
|
77f1177 |
--
|
|
|
77f1177 |
cgit v0.9.0.2
|