emacs/gnu.emacs
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/emacs.git synced 2026-09-10 15:56:35 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix OOB read in Android TrueType font scan

Browse source 
Problem reported privately by Michal Majchrowicz and Marcin
Wyczechowski, members of the AFINE Team.
* src/sfnt.c (sfnt_vary_simple_glyph, sfnt_vary_compound_glyph):
Reject indexes equal exactly to sizes.
This commit is contained in:
Paul Eggert 2026-07-07 12:43:41 -07:00
parent 4ccf2584e3
commit 95ab9ef627
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/sfnt.c
View file

@ -15905,8 +15905,8 @@ sfnt_vary_simple_glyph (struct sfnt_blend *blend, sfnt_glyph id,
sfnt_swap16 (&coords[j]);
}
}
else if ((index & 0xfff) > gvar->shared_coord_count)
/* index exceeds the number of shared tuples present. */
else if (gvar->shared_coord_count <= (index & 0xfff))
/* The index is too large. */
goto fail1;
else
/* index points into gvar->axis_count coordinates making up
@ -16277,8 +16277,8 @@ sfnt_vary_compound_glyph (struct sfnt_blend *blend, sfnt_glyph id,
sfnt_swap16 (&coords[j]);
}
}
else if ((index & 0xfff) > gvar->shared_coord_count)
/* index exceeds the number of shared tuples present. */
else if (gvar->shared_coord_count <= (index & 0xfff))
/* The index is too large. */
goto fail1;
else
/* index points into gvar->axis_count coordinates making up