From 6dcfda92c17a7701479118751a8290246e9a3c05 Mon Sep 17 00:00:00 2001 From: Michiharu Ariza Date: Wed, 5 Dec 2018 15:07:46 -0800 Subject: [PATCH] sanitize CFF1 & CFF2 global subrs --- src/hb-ot-cff1-table.hh | 2 +- src/hb-ot-cff2-table.hh | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/hb-ot-cff1-table.hh b/src/hb-ot-cff1-table.hh index 39da8fa..10ce8ff 100644 --- a/src/hb-ot-cff1-table.hh +++ b/src/hb-ot-cff1-table.hh @@ -1067,7 +1067,7 @@ struct cff1 { fini (); return; } globalSubrs = &StructAtOffset (stringIndex, stringIndex->get_size ()); - if ((globalSubrs != &Null (CFF1Subrs)) && !stringIndex->sanitize (&sc)) + if ((globalSubrs != &Null (CFF1Subrs)) && !globalSubrs->sanitize (&sc)) { fini (); return; } charStrings = &StructAtOffsetOrNull (cff, topDict.charStringsOffset); diff --git a/src/hb-ot-cff2-table.hh b/src/hb-ot-cff2-table.hh index 178acf0..5b8e6c7 100644 --- a/src/hb-ot-cff2-table.hh +++ b/src/hb-ot-cff2-table.hh @@ -466,6 +466,7 @@ struct cff2 if (((varStore != &Null(CFF2VariationStore)) && unlikely (!varStore->sanitize (&sc))) || (charStrings == &Null(CFF2CharStrings)) || unlikely (!charStrings->sanitize (&sc)) || + (globalSubrs == &Null(CFF2Subrs)) || unlikely (!globalSubrs->sanitize (&sc)) || (fdArray == &Null(CFF2FDArray)) || unlikely (!fdArray->sanitize (&sc)) || (((fdSelect != &Null(CFF2FDSelect)) && unlikely (!fdSelect->sanitize (&sc, fdArray->count))))) { fini (); return; } -- 2.7.4