[sfnt] Avoid nullptr dereference in reading malformed `COLR` v1. (!246) · Merge requests · FreeType / FreeType · GitLab

Due to an influx of spam, we have had to impose restrictions on new accounts. Please see this wiki page for instructions on how to get full permissions. Sorry for the inconvenience.

Dominik Röttsches requested to merge drott/freetype:fuzzFix into master Jan 17, 2023

Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=1408044.

src/sfnt/ttcolr.c (tt_face_load_colr): When the COLR v1 header is too small, avoid trying to deallocate delta set index map structures.