tree b69b87b4014b57170524902f55daaf83f105b267
parent 706c79a1da4aeb05c331f6ff0a7051e7613d5aba
author Werner Lemberg <wl@gnu.org> 1642848330 +0100
committer Werner Lemberg <wl@gnu.org> 1642849748 +0100

[sfnt] Reject malformed SVG tables.

* src/sfnt/ttsvg.c (SVG_TABLE_HEADER_SIZE, SVG_DOCUMENT_RECORD_SIZE,
SVG_DOCUMENT_LIST_MINIMUM_SIZE, SVG_MINIMUM_SIZE): New macros.
(tt_face_load_svg): Check offsets.
Check table and record sizes.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43918