diff options
| author | LE GARREC Vincent <gitlab-freedesktop@le-garrec.fr> | 2019-03-31 20:49:25 +0000 |
|---|---|---|
| committer | Albert Astals Cid <tsdgeos@yahoo.es> | 2019-03-31 20:49:25 +0000 |
| commit | ea12ae67be12883e4626b34db8f2f849fb6d56d7 (patch) | |
| tree | 7aa292157016a6e1094441ed95c57c0adb0b57f8 /fofi | |
| parent | 516e6149572a16747f21d6510f844b5879954ec0 (diff) | |
ofz-8443: Integer-overflow in identifyCFF
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8443
Diffstat (limited to 'fofi')
| -rw-r--r-- | fofi/FoFiIdentifier.cc | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/fofi/FoFiIdentifier.cc b/fofi/FoFiIdentifier.cc index 6e4ba70f..36863226 100644 --- a/fofi/FoFiIdentifier.cc +++ b/fofi/FoFiIdentifier.cc @@ -16,6 +16,7 @@ // Copyright (C) 2013 Christoph Duelli <duelli@melosgmbh.de> // Copyright (C) 2018 Albert Astals Cid <aacid@kde.org> // Copyright (C) 2019 Christian Persch <chpe@src.gnome.org> +// Copyright (C) 2019 LE GARREC Vincent <legarrec.vincent@gmail.com> // // To see a description of the changes please see the Changelog file that // came with your tarball or type make ChangeLog if you are building from git @@ -26,6 +27,7 @@ #include <string.h> #include <limits.h> #include "goo/gfile.h" +#include "goo/GooCheckedOps.h" #include "FoFiIdentifier.h" //------------------------------------------------------------------------ @@ -614,9 +616,9 @@ static FoFiIdentifierType identifyCFF(Reader *reader, int start) { offset0 > offset1) { return fofiIdUnknown; } - pos = pos + 3 + (n + 1) * offSize1 + (int)offset0 - 1; - endPos = pos + 3 + (n + 1) * offSize1 + (int)offset1 - 1; - if (pos < 0 || endPos < 0 || pos > endPos) { + if (checkedAdd(pos + 3 + (n + 1) * offSize1, (int)offset0 - 1, &pos) || + checkedAdd(pos + 3 + (n + 1) * offSize1, (int)offset1 - 1, &endPos) || + pos < 0 || endPos < 0 || pos > endPos) { return fofiIdUnknown; } |