Fix an out of bounds access found by libFuzzer

This commit is contained in:
Rod Sheeter
2016-05-17 16:00:38 -07:00
parent a15a8ab86b
commit 8f3ff26c37
+6
View File
@@ -681,6 +681,12 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf,
return FONT_COMPRESSION_FAILURE(); return FONT_COMPRESSION_FAILURE();
} }
// https://www.microsoft.com/typography/otspec/hmtx.htm
// "...only one entry need be in the array, but that entry is required."
if (PREDICT_FALSE(num_hmetrics < 1)) {
return FONT_COMPRESSION_FAILURE();
}
for (uint16_t i = 0; i < num_hmetrics; i++) { for (uint16_t i = 0; i < num_hmetrics; i++) {
uint16_t advance_width; uint16_t advance_width;
if (PREDICT_FALSE(!hmtx_buff_in.ReadU16(&advance_width))) { if (PREDICT_FALSE(!hmtx_buff_in.ReadU16(&advance_width))) {