commit 1167bff3e9a6302687667c6134673e4b3fd13636
author Werner Lemberg <wl@gnu.org> Sun Oct 06 23:22:34 2019 +0200
committer Werner Lemberg <wl@gnu.org> Sun Oct 06 23:22:34 2019 +0200
tree 53a3e3e9261be0d5d3710e1f47c41c4a59a6d37a
parent 0fcf486e0d6f3bb1cb17b6a6f00f651e21077dda

* src/sfnt/sfwoff2 (reconstruct_glyf): Fix reallocation.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18046

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 7536383..e6a4528 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2019-10-06  Werner Lemberg  <wl@gnu.org>
 
+	* src/sfnt/sfwoff2 (reconstruct_glyf): Fix reallocation.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18046
+
+2019-10-06  Werner Lemberg  <wl@gnu.org>
+
 	Improve memory debugging.
 
 	* include/freetype/internal/ftmemory.h (FT_MEM_FREE): Use

src/sfnt/sfwoff2.c

diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c
index 32a797b..2468425 100644
--- a/src/sfnt/sfwoff2.c
+++ b/src/sfnt/sfwoff2.c
@@ -1235,6 +1235,9 @@
     if ( !error )
       error = FT_THROW( Invalid_Table );
 
+    /* Set pointer `sfnt_bytes' to its correct value. */
+    *sfnt_bytes = sfnt;
+
     FT_FREE( substreams );
     FT_FREE( loca_values );
     FT_FREE( n_points_arr );