Merge pull request #1458 from harfbuzz/cff-check-blends
[CFF] oss-fuzz issue 11714: set_blends
diff --git a/src/hb-cff2-interp-cs.hh b/src/hb-cff2-interp-cs.hh
index d258b81..18e8468 100644
--- a/src/hb-cff2-interp-cs.hh
+++ b/src/hb-cff2-interp-cs.hh
@@ -235,6 +235,11 @@
env.process_blend ();
k = env.get_region_count ();
n = env.argStack.pop_uint ();
+ if (unlikely (env.argStack.get_count () < ((k+1) * n)))
+ {
+ env.set_error ();
+ return;
+ }
/* copy the blend values into blend array of the default values */
unsigned int start = env.argStack.get_count () - ((k+1) * n);
for (unsigned int i = 0; i < n; i++)
diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5710107829075968 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5710107829075968
new file mode 100644
index 0000000..5fef2f8
--- /dev/null
+++ b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5710107829075968
Binary files differ
