commit bfe53294757b03873b1432b7c1cd3e027802c634
author Werner Lemberg <wl@gnu.org> Sat Oct 27 00:07:53 2018 +0200
committer Werner Lemberg <wl@gnu.org> Sat Oct 27 00:07:53 2018 +0200
tree 41ec6f8f5e4b5eb94dfa9bf74ef262e7fbefb4dc
parent f56830ed406f90f6f53ee6367f2068a0f27bf90b

[psaux] Fix numeric overflow.

Triggered by

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157

* src/psaux/cffdecode.c (cff_decoder_parse_charstrings) <cff_op_blend>
[CFF_CONFIG_OPTION_OLD_ENGINE]: Fix integer overflow.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index d96be84..5bb6ba7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2018-10-27  Werner Lemberg  <wl@gnu.org>
+
+	[psaux] Fix numeric overflow.
+
+	Triggered by
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11157
+
+	* src/psaux/cffdecode.c (cff_decoder_parse_charstrings) <cff_op_blend>
+	[CFF_CONFIG_OPTION_OLD_ENGINE]: Fix integer overflow.
+
 2018-10-20  Werner Lemberg  <wl@gnu.org>
 
 	Avoid endless loop while tracing (#54858).

src/psaux/cffdecode.c

diff --git a/src/psaux/cffdecode.c b/src/psaux/cffdecode.c
index 58a516f..ac1bc1f 100644
--- a/src/psaux/cffdecode.c
+++ b/src/psaux/cffdecode.c
@@ -1950,7 +1950,8 @@
             if ( num_results < 0 )
               goto Syntax_Error;
 
-            if ( num_results * (FT_Int)num_designs > num_args )
+            if ( num_results > num_args                       ||
+                 num_results * (FT_Int)num_designs > num_args )
               goto Stack_Underflow;
 
             /* since we currently don't handle interpolation of multiple */