diff options
author | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2023-06-09 17:30:54 +0300 |
---|---|---|
committer | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2023-06-09 17:30:54 +0300 |
commit | da6e958319e95fe564d3b30c931492dd666bfaff (patch) | |
tree | 16ac1556a573daeba5c9c4b795f86aa166ffe467 /src/3rdparty/freetype/src/sfnt/ttcmap.c | |
parent | 29400a683f96867133b28299c0d0bd6bcf40df35 (diff) | |
parent | a96fc76fa78f3500266b3a34016f9e1bd29b319c (diff) |
Merge remote-tracking branch 'origin/tqtc/lts-5.15.11' into tqtc/lts-5.15-opensourcev5.15.11-lts-lgpl
Change-Id: Iac056a5e9f59fc8d1929171c18039aeb45be22b8
Diffstat (limited to 'src/3rdparty/freetype/src/sfnt/ttcmap.c')
-rw-r--r-- | src/3rdparty/freetype/src/sfnt/ttcmap.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/3rdparty/freetype/src/sfnt/ttcmap.c b/src/3rdparty/freetype/src/sfnt/ttcmap.c index 556a712199..bfeabacb7d 100644 --- a/src/3rdparty/freetype/src/sfnt/ttcmap.c +++ b/src/3rdparty/freetype/src/sfnt/ttcmap.c @@ -4,7 +4,7 @@ * * TrueType character mapping table (cmap) support (body). * - * Copyright (C) 2002-2020 by + * Copyright (C) 2002-2022 by * David Turner, Robert Wilhelm, and Werner Lemberg. * * This file is part of the FreeType project, and may only be used, @@ -465,7 +465,7 @@ if ( subheader ) { FT_Byte* p = subheader; - FT_UInt idx = (FT_UInt)(char_code & 0xFF); + FT_UInt idx = (FT_UInt)( char_code & 0xFF ); FT_UInt start, count; FT_Int delta; FT_UInt offset; @@ -916,6 +916,16 @@ length = (FT_UInt)( valid->limit - table ); } + /* it also happens that the `length' field is too small; */ + /* this is easy to correct */ + if ( length < (FT_UInt)( valid->limit - table ) ) + { + if ( valid->level >= FT_VALIDATE_PARANOID ) + FT_INVALID_DATA; + + length = (FT_UInt)( valid->limit - table ); + } + if ( length < 16 ) FT_INVALID_TOO_SHORT; |