commit 6d62076ae5d000612202aeae99c71ce27fdb2fb1
author Dominik Röttsches <drott@chromium.org> Tue Aug 30 15:00:37 2022 +0300
committer Werner Lemberg <wl@gnu.org> Mon Sep 05 12:23:31 2022 +0200
tree f81a884b891e373d24d880d452af69801e219148
parent 048f2e247c3ebe84fb26e52198d05e4c586764df

[sfnt] Pointer sanity checks before reading layer info in 'COLR' v0

* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to
read from is within the 'COLR' table.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633

src/sfnt/ttcolr.c

diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index 1277bbd..ad0f127 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -481,7 +481,9 @@
       iterator->p = colr->layers + offset;
     }
 
-    if ( iterator->layer >= iterator->num_layers )
+    if ( iterator->layer >= iterator->num_layers                     ||
+         iterator->p < colr->layers                                  ||
+         iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) )
       return 0;
 
     *aglyph_index = FT_NEXT_USHORT( iterator->p );