Skip to content

[sfnt] Reject `COLR` table if version is 1 but header too small

Dominik Röttsches requested to merge drott/freetype:colrFix into master

Fixes #1179 (closed). Original patch by Sergey Temnikov.

  • src/sfnt/ttcolr.c (tt_face_load_colr): If the version is determined to be 1, then the table size has to be at least the size of the v1 header. Also, for peeking number of base glyphs, and number of entries in the layer list, ensure that the table is sufficiently long.

Merge request reports