Skip to content

[svg] Add document bounds checking

Ben Wagner requested to merge bungeman/freetype:svg_document_content_check into master

Add a check that the document content is actually contained within the SVG table. Without this check a malformed font may claim arbitrary memory as its document content.

  • src/sfnt/ttsvg.c (tt_face_load_svg): take numEntries into account when testing documentRecord extents. (find_doc): rename stream to document_records for clarity. (tt_face_load_svg_doc): split doc from doc_list pointer for clarity. Test that the document content is contained within the table. Ensure minimum length of document before testing for gzip format.

Reported as:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51812

Edited by Ben Wagner

Merge request reports