diff options
| author | Behdad Esfahbod <behdad@behdad.org> | 2015-10-15 12:47:22 -0300 |
|---|---|---|
| committer | Behdad Esfahbod <behdad@behdad.org> | 2015-10-15 12:54:28 -0300 |
| commit | 63ef0b41dc48d6112d1918c1b1de9de8ea90adb5 (patch) | |
| tree | 9e757d1b11ce326ce843a7da58d2ae42bf2b4844 | |
| parent | 613e630617074eb9b62b794cc37c9b42a7fb079b (diff) | |
[ot-font] Fix hmtx wrong table length check
Discovered by libFuzzer. Ouch!
https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957
| -rw-r--r-- | src/hb-ot-font.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/hb-ot-font.cc b/src/hb-ot-font.cc index 3102784e..69d2503a 100644 --- a/src/hb-ot-font.cc +++ b/src/hb-ot-font.cc @@ -59,7 +59,7 @@ struct hb_ot_face_metrics_accelerator_t this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag)); if (unlikely (!this->num_advances || - 2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob))) + 2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob))) { this->num_metrics = this->num_advances = 0; hb_blob_destroy (this->blob); |