mingw-freetype/SOURCES/freetype-2.8.3-cve-2025-27363.patch
2025-05-29 08:01:34 +00:00

27 lines
908 B
Diff

--- a/src/truetype/ttgload.c 2017-05-04 00:40:41.000000000 +0300
+++ b/src/truetype/ttgload.c 2025-04-29 14:41:33.773082591 +0300
@@ -1753,7 +1753,7 @@
short i, limit;
FT_SubGlyph subglyph;
- FT_Outline outline;
+ FT_Outline outline = { 0, 0, NULL, NULL, NULL, 0 };
FT_Vector* points = NULL;
char* tags = NULL;
short* contours = NULL;
@@ -1761,6 +1761,14 @@
limit = (short)gloader->current.num_subglyphs;
+ /* make sure this isn't negative as we're going to add 4 later */
+ if ( limit < 0 )
+ {
+ error = FT_THROW( Invalid_Argument );
+ goto Exit;
+ }
+
+
/* construct an outline structure for */
/* communication with `TT_Vary_Apply_Glyph_Deltas' */
outline.n_points = (short)( gloader->current.num_subglyphs + 4 );