commit 99f23d6ff2203966d210bccd49eacc62a20328f9
author Werner Lemberg <wl@gnu.org> Tue Sep 17 13:22:28 2019 +0200
committer Werner Lemberg <wl@gnu.org> Tue Sep 17 13:22:28 2019 +0200
tree 39376c6a23e1e35cf9d71e0f82e823bd508d8786
parent cc17f852d575a8a66f9be51461af550d0f413891

* src/sfnt/sfwoff2.c (woff2_open_font): Check table index.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17100

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 39ce8c0..03292f1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-09-17  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/sfwoff2.c (woff2_open_font): Check table index.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17100
+
 2019-09-15  Avi Halachmi (:avih)  <avihpit@yahoo.com>
 
 	[cmake] Don't fail if brotli is missing (#56894).

src/sfnt/sfwoff2.c

diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c
index 9beb01f..bea73c3 100644
--- a/src/sfnt/sfwoff2.c
+++ b/src/sfnt/sfwoff2.c
@@ -1975,6 +1975,13 @@
             goto Exit;
 
           FT_TRACE6(( "%hu ", table_index ));
+          if ( table_index >= woff2.num_tables )
+          {
+            FT_ERROR(( "woff2_open_font: invalid table index\n" ));
+            error = FT_THROW( Invalid_Table );
+            goto Exit;
+          }
+
           ttc_font->table_indices[j] = table_index;
 
           table = indices[table_index];