| commit | 8e68439a6ffc9e489a70f2c278a016fe15394abf | [log] [tgz] |
|---|---|---|
| author | Dominik Röttsches <drott@chromium.org> | Tue Sep 06 15:57:11 2022 +0300 |
| committer | Werner Lemberg <wl@gnu.org> | Tue Sep 06 17:18:17 2022 +0200 |
| tree | 98a2f2b190ba3fd9579fc8d9f4519001dbdcc993 | |
| parent | 91a7fae777fb0ce1e53411cffa1cd310feaa9d00 [diff] |
[truetype] Reject 'fvar' loading when `num_instances` is too small. * src/truetype/ttgxvar.c (TT_Get_MM_Var): Reject retrieving master when 'fvar' values locally do not match with sanitized values from initialization at `sfnt_init_face` time. Reported as https://bugs.chromium.org/p/chromium/issues/detail?id=1360295