Fix a crash bug in the woff2 decoder when totalSfntSize in the woff2 header is <= 0.

2017-07-19 17:35:57 -07:00
parent 849bdb0d24
commit 44ab8c45d7
1 changed files with 3 additions and 0 deletions
@@ -1299,6 +1299,9 @@ bool ConvertWOFF2ToTTF(const uint8_t* data, size_t length,

  const uint8_t* src_buf = data + hdr.compressed_offset;
  std::vector<uint8_t> uncompressed_buf(hdr.uncompressed_size);
+  if (PREDICT_FALSE(hdr.uncompressed_size < 1)) {
+    return FONT_COMPRESSION_FAILURE();
+  }
  if (PREDICT_FALSE(!Woff2Uncompress(&uncompressed_buf[0],
                                     hdr.uncompressed_size, src_buf,
                                     hdr.compressed_length))) {