commit e662a9500f826a7f534170e981da4987ca8d83f3
author Dominik Röttsches <drott@chromium.org> Mon Apr 19 12:49:16 2021 +0300
committer Dominik Röttsches <drott@chromium.org> Mon Apr 19 12:49:16 2021 +0300
tree 26e4a6c06a62fdb85b715ec0e73c871b29ea9fb9
parent 7c685cb3f636a2fb9962e9fc371e5007e6f5258d

[sfnt] Return in 'COLR' v1 when layer pointer outside table

* src/sfnt/ttcolr.c (tt_face_get_paint_layers): Add missing return
when paint pointer outside table.
(read_paint): Add missing return when paint pointer outside table.

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 4b41688..9bd9553 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2021-04-19  Dominik Röttsches  <drott@chromium.org>
+
+	[sfnt] Return in 'COLR' v1 when layer pointer outside table
+
+	* src/sfnt/ttcolr.c (tt_face_get_paint_layers): Add missing return
+	when paint pointer outside table.
+	(read_paint): Add missing return when paint pointer outside table.
+
 2021-04-18  Alexei Podtelezhnikov  <apodtele@gmail.com>
 
 	[cache] Switch to lazy SBit setting.

src/sfnt/ttcolr.c

diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index 617ba93..f3f396a 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -390,6 +390,7 @@
 
     if ( p < colr->base_glyphs_v1                          ||
          p >= ( (FT_Byte*)colr->table + colr->table_size ) )
+      return 0;
 
     apaint->format = FT_NEXT_BYTE( p );
 
@@ -725,6 +726,7 @@
 
     if ( p_paint < colr->base_glyphs_v1                          ||
          p_paint >= ( (FT_Byte*)colr->table + colr->table_size ) )
+      return 0;
 
     opaque_paint->p = p_paint;