commit 257c270bd25e15890190a28a1456e7623bba4439
author Werner Lemberg <wl@gnu.org> Wed Nov 12 21:42:13 2014 +0100
committer Werner Lemberg <wl@gnu.org> Wed Nov 12 21:42:13 2014 +0100
tree e604762faf36a682806f0da43756e2e791b0d512
parent 677ddf4f1dc1b36cef7c7ddd59a14c508f4b1891

[sfnt] Fix Savannah bug #43591.

* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
and multiplication overflow.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index b42b929..a6465e7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2014-11-12  Werner Lemberg  <wl@gnu.org>
 
+	[sfnt] Fix Savannah bug #43591.
+
+	* src/sfnt/ttsbit.c (tt_sbit_decoder_init): Protect against addition
+	and multiplication overflow.
+
+2014-11-12  Werner Lemberg  <wl@gnu.org>
+
 	[sfnt] Fix Savannah bug #43590.
 
 	* src/sfnt/ttload.c (check_table_dir, tt_face_load_font_dir):

src/sfnt/ttsbit.c

diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index da6b01b..b37bd7d 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -394,9 +394,11 @@
       p                          += 34;
       decoder->bit_depth          = *p;
 
-      if ( decoder->strike_index_array > face->sbit_table_size             ||
-           decoder->strike_index_array + 8 * decoder->strike_index_count >
-             face->sbit_table_size                                         )
+      /* decoder->strike_index_array +                               */
+      /*   8 * decoder->strike_index_count > face->sbit_table_size ? */
+      if ( decoder->strike_index_array > face->sbit_table_size           ||
+           decoder->strike_index_count >
+             ( face->sbit_table_size - decoder->strike_index_array ) / 8 )
         error = FT_THROW( Invalid_File_Format );
     }