| Index: src/gdef.cc
|
| ===================================================================
|
| --- src/gdef.cc (revision 50)
|
| +++ src/gdef.cc (working copy)
|
| @@ -4,6 +4,7 @@
|
|
|
| #include "gdef.h"
|
|
|
| +#include <limits>
|
| #include <vector>
|
|
|
| #include "layout.h"
|
| @@ -40,6 +41,9 @@
|
| return OTS_FAILURE();
|
| }
|
| const unsigned attach_points_end = static_cast<unsigned>(4) + 2*glyph_count;
|
| + if (attach_points_end > std::numeric_limits<uint16_t>::max()) {
|
| + return OTS_FAILURE();
|
| + }
|
| if (offset_coverage == 0 || offset_coverage >= length ||
|
| offset_coverage < attach_points_end) {
|
| return OTS_FAILURE();
|
| @@ -105,6 +109,9 @@
|
| return OTS_FAILURE();
|
| }
|
| const unsigned lig_glyphs_end = static_cast<unsigned>(4) + 2*lig_glyph_count;
|
| + if (lig_glyphs_end > std::numeric_limits<uint16_t>::max()) {
|
| + return OTS_FAILURE();
|
| + }
|
| if (offset_coverage == 0 || offset_coverage >= length ||
|
| offset_coverage < lig_glyphs_end) {
|
| return OTS_FAILURE();
|
| @@ -207,6 +214,9 @@
|
| }
|
|
|
| const unsigned mark_sets_end = static_cast<unsigned>(4) + 2*mark_set_count;
|
| + if (mark_sets_end > std::numeric_limits<uint16_t>::max()) {
|
| + return OTS_FAILURE();
|
| + }
|
| for (unsigned i = 0; i < mark_set_count; ++i) {
|
| uint32_t offset_coverage = 0;
|
| if (!subtable.ReadU32(&offset_coverage)) {
|
| @@ -221,6 +231,7 @@
|
| return OTS_FAILURE();
|
| }
|
| }
|
| + file->gdef->num_mark_glyph_sets = mark_set_count;
|
| return true;
|
| }
|
|
|
| @@ -277,6 +288,10 @@
|
|
|
| const unsigned gdef_header_end = static_cast<unsigned>(8) +
|
| gdef->version_2 ? static_cast<unsigned>(2) : static_cast<unsigned>(0);
|
| + if (gdef_header_end > std::numeric_limits<uint16_t>::max()) {
|
| + return OTS_FAILURE();
|
| + }
|
| +
|
| // Parse subtables
|
| if (offset_glyph_class_def) {
|
| if (offset_glyph_class_def >= length ||
|
| @@ -329,6 +344,7 @@
|
| DROP_THIS_TABLE;
|
| return true;
|
| }
|
| + gdef->has_mark_attachment_class_def = true;
|
| }
|
|
|
| if (offset_mark_glyph_sets_def) {
|
| @@ -343,6 +359,7 @@
|
| DROP_THIS_TABLE;
|
| return true;
|
| }
|
| + gdef->has_mark_glyph_sets_def = true;
|
| }
|
| gdef->data = data;
|
| gdef->length = length;
|
|
|