Commit f966b876 authored by Carlos Garcia Campos's avatar Carlos Garcia Campos

fofi: Fix a crash when parsing an invalid font due to a integer overflow

This fixes a crash rendering trust_metrics.f2495.f0.pdf.
parent 4963332c
......@@ -263,7 +263,7 @@ void FoFiType1::parse() {
} else {
break;
}
for (; *p >= '0' && *p < '0' + base; ++p) {
for (; *p >= '0' && *p < '0' + base && code < INT_MAX / (base + (*p - '0')); ++p) {
code = code * base + (*p - '0');
}
for (; *p == ' ' || *p == '\t'; ++p) ;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment