commit 447a0b62634802d8acdb56008cff5ff4e50be244
author Werner Lemberg <wl@gnu.org> Mon Mar 13 07:42:34 2017 +0100
committer Werner Lemberg <wl@gnu.org> Mon Mar 13 07:42:34 2017 +0100
tree 85a605ffe3768e980c0885ccf54f07394aafb1db
parent 5eb0fd5e97c2af7aaeeb129571b2b820c5079604

[truetype] Ignore invalid MVAR tags.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=838

* src/truetype/ttgxvar.c (ft_var_load_mvar): Ignore value and emit
warning for invalid tags.
(tt_apply_mvar): Ignore invalid tags.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 6fb4fc9..091724f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2017-03-13  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Ignore invalid MVAR tags.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=838
+
+	* src/truetype/ttgxvar.c (ft_var_load_mvar): Ignore value and emit
+	warning for invalid tags.
+	(tt_apply_mvar): Ignore invalid tags.
+
 2017-03-12  Werner Lemberg  <wl@gnu.org>
 
 	[truetype] Store and use design coordinates also.

src/truetype/ttgxvar.c

diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 5abcd02..3277905 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1263,7 +1263,16 @@
       FT_Short*  p = ft_var_get_value_pointer( face, value->tag );
 
 
-      value->unmodified = *p;
+      if ( p )
+        value->unmodified = *p;
+#ifdef FT_DEBUG_LEVEL_TRACE
+      else
+        FT_TRACE1(( "ft_var_load_mvar: Ignoring unknown tag `%c%c%c%c'\n",
+                    (FT_Char)( value->tag >> 24 ),
+                    (FT_Char)( value->tag >> 16 ),
+                    (FT_Char)( value->tag >> 8 ),
+                    (FT_Char)( value->tag ) ));
+#endif
     }
 
     face->variation_support |= TT_FACE_FLAG_VAR_MVAR;
@@ -1320,17 +1329,20 @@
                                      value->outerIndex,
                                      value->innerIndex );
 
-      FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
-                  (FT_Char)( value->tag >> 24 ),
-                  (FT_Char)( value->tag >> 16 ),
-                  (FT_Char)( value->tag >> 8 ),
-                  (FT_Char)( value->tag ),
-                  value->unmodified,
-                  delta ));
+      if ( p )
+      {
+        FT_TRACE5(( "value %c%c%c%c (%d units) adjusted by %d units (MVAR)\n",
+                    (FT_Char)( value->tag >> 24 ),
+                    (FT_Char)( value->tag >> 16 ),
+                    (FT_Char)( value->tag >> 8 ),
+                    (FT_Char)( value->tag ),
+                    value->unmodified,
+                    delta ));
 
-      /* since we handle both signed and unsigned values as FT_Short, */
-      /* ensure proper overflow arithmetic                            */
-      *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+        /* since we handle both signed and unsigned values as FT_Short, */
+        /* ensure proper overflow arithmetic                            */
+        *p = (FT_Short)( value->unmodified + (FT_Short)delta );
+      }
     }
 
     /* adjust all derived values */