zumun/woff2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't accept too long totalSfntSize

Browse Source 
Per the spec (WOFF 2.0 spec just refer to WOFF 1.0 spec here):
http://www.w3.org/TR/2012/REC-WOFF-20121213/#conform-totalsize-longword-reject
This commit is contained in:
Khaled Hosny
2015-02-01 09:22:50 +02:00
parent 7375be53fc
commit 0634e0a719
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/woff2_dec.cc
+2 -2
View File
@@ -807,7 +807,7 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
} }
// We don't care about these fields of the header: // We don't care about these fields of the header:
// uint16_t reserved // uint16_t reserved
// uint32_t total_sfnt_size // uint32_t total_sfnt_size, the caller already passes it as result_length
if (!file.Skip(6)) { if (!file.Skip(6)) {
return FONT_COMPRESSION_FAILURE(); return FONT_COMPRESSION_FAILURE();
} }
@@ -926,7 +926,7 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
if (uncompressed_sum > 30 * 1024 * 1024) { if (uncompressed_sum > 30 * 1024 * 1024) {
return FONT_COMPRESSION_FAILURE(); return FONT_COMPRESSION_FAILURE();
} }
if (src_offset > length || dst_offset > result_length) { if (src_offset > length || dst_offset != result_length) {
fprintf(stderr, "offset fail; src_offset %lu length %lu " fprintf(stderr, "offset fail; src_offset %lu length %lu "
"dst_offset %lu result_length %lu\n", "dst_offset %lu result_length %lu\n",
src_offset, length, dst_offset, result_length); src_offset, length, dst_offset, result_length);