Update woff2_dec.cc range checking
This commit is contained in:
+3
-2
@@ -26,8 +26,8 @@
|
|||||||
#include <map>
|
#include <map>
|
||||||
#include <memory>
|
#include <memory>
|
||||||
|
|
||||||
#include "./buffer.h"
|
|
||||||
#include "./decode.h"
|
#include "./decode.h"
|
||||||
|
#include "./buffer.h"
|
||||||
#include "./port.h"
|
#include "./port.h"
|
||||||
#include "./round.h"
|
#include "./round.h"
|
||||||
#include "./store_bytes.h"
|
#include "./store_bytes.h"
|
||||||
@@ -1121,7 +1121,8 @@ bool ConvertWOFF2ToTTF(uint8_t* result, size_t result_length,
|
|||||||
|
|
||||||
for (uint32_t j = 0; j < num_tables; j++) {
|
for (uint32_t j = 0; j < num_tables; j++) {
|
||||||
unsigned int table_idx;
|
unsigned int table_idx;
|
||||||
if (PREDICT_FALSE(!Read255UShort(&file, &table_idx))) {
|
if (PREDICT_FALSE(!Read255UShort(&file, &table_idx)) ||
|
||||||
|
table_idx >= tables.size()) {
|
||||||
return FONT_COMPRESSION_FAILURE();
|
return FONT_COMPRESSION_FAILURE();
|
||||||
}
|
}
|
||||||
ttc_font.table_indices[j] = table_idx;
|
ttc_font.table_indices[j] = table_idx;
|
||||||
|
|||||||
Reference in New Issue
Block a user