tree 98a2f2b190ba3fd9579fc8d9f4519001dbdcc993
parent 91a7fae777fb0ce1e53411cffa1cd310feaa9d00
author Dominik Röttsches <drott@chromium.org> 1662469031 +0300
committer Werner Lemberg <wl@gnu.org> 1662477497 +0200

[truetype] Reject 'fvar' loading when `num_instances` is too small.

* src/truetype/ttgxvar.c (TT_Get_MM_Var): Reject retrieving master when
'fvar' values locally do not match with sanitized values from initialization
at `sfnt_init_face` time.

Reported as

  https://bugs.chromium.org/p/chromium/issues/detail?id=1360295