tree 3cfc5b953fddd4f30422cc176a3fd6956c3d0163
parent d5804e3937a961736e5cef0e8a70eacf91ee00bb
author Raph Levien <raph@google.com> 1448924699 -0800
committer Raph Levien <raph@google.com> 1449511092 +0000

Avoid integer overflows in parsing fonts

A malformed TTF can cause size calculations to overflow. This patch
checks the maximum reasonable value so that the total size fits in 32
bits. It also adds some explicit casting to avoid possible technical
undefined behavior when parsing sized unsigned values.

Bug: 25645298
Change-Id: Id4716132041a6f4f1fbb73ec4e445391cf7d9616
(cherry picked from commit 183c9ec2800baa2ce099ee260c6cbc6121cf1274)