mirror of
https://github.com/michaelrsweet/pdfio.git
synced 2025-08-29 15:22:06 +02:00
Fix a potential heap overflow in the TrueType cmap code.
This commit is contained in:
6
ttf.c
6
ttf.c
@@ -3,7 +3,7 @@
|
||||
//
|
||||
// https://github.com/michaelrsweet/ttf
|
||||
//
|
||||
// Copyright © 2018-2024 by Michael R Sweet.
|
||||
// Copyright © 2018-2025 by Michael R Sweet.
|
||||
//
|
||||
// Licensed under Apache License v2.0. See the file "LICENSE" for more
|
||||
// information.
|
||||
@@ -1460,7 +1460,7 @@ read_cmap(ttf_t *font) // I - Font
|
||||
// array...
|
||||
for (gidx = 0, group = groups; gidx < nGroups; gidx ++, group ++)
|
||||
{
|
||||
for (ch = group->startCharCode; ch <= group->endCharCode && ch < TTF_FONT_MAX_CHAR; ch ++)
|
||||
for (ch = group->startCharCode; ch <= group->endCharCode && ch < font->num_cmap; ch ++)
|
||||
cmapptr[ch] = (int)(group->startGlyphID + ch - group->startCharCode);
|
||||
}
|
||||
|
||||
@@ -1551,7 +1551,7 @@ read_cmap(ttf_t *font) // I - Font
|
||||
// array...
|
||||
for (gidx = 0, group = groups; gidx < nGroups; gidx ++, group ++)
|
||||
{
|
||||
for (ch = group->startCharCode; ch <= group->endCharCode && ch < TTF_FONT_MAX_CHAR; ch ++)
|
||||
for (ch = group->startCharCode; ch <= group->endCharCode && ch < font->num_cmap; ch ++)
|
||||
cmapptr[ch] = (int)group->glyphID;
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user