| Index: core/src/fxge/ge/fx_ge_fontmap.cpp
|
| diff --git a/core/src/fxge/ge/fx_ge_fontmap.cpp b/core/src/fxge/ge/fx_ge_fontmap.cpp
|
| index 9a8380b77e9bd6d85aab77a5feda19be0c24ad82..c668f54834af7f2fc584814f215cf10e88a7fdbb 100644
|
| --- a/core/src/fxge/ge/fx_ge_fontmap.cpp
|
| +++ b/core/src/fxge/ge/fx_ge_fontmap.cpp
|
| @@ -1464,14 +1464,29 @@ void CFX_FolderFontInfo::ScanFile(CFX_ByteString& path)
|
| FX_BYTE buffer[16];
|
| FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET);
|
| size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile);
|
| + if (readCnt != 1) {
|
| + FXSYS_fclose(pFile);
|
| + return;
|
| + }
|
| +
|
| if (GET_TT_LONG(buffer) == 0x74746366) {
|
| FX_DWORD nFaces = GET_TT_LONG(buffer + 8);
|
| - FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4);
|
| + if (nFaces > FX_DWORD_MAX / 4) {
|
| + FXSYS_fclose(pFile);
|
| + return;
|
| + }
|
| + FX_DWORD face_bytes = nFaces * 4;
|
| + FX_LPBYTE offsets = FX_Alloc(FX_BYTE, face_bytes);
|
| if (!offsets) {
|
| FXSYS_fclose(pFile);
|
| return;
|
| }
|
| - readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile);
|
| + readCnt = FXSYS_fread(offsets, face_bytes, 1, pFile);
|
| + if (readCnt != face_bytes) {
|
| + FX_Free(offsets);
|
| + FXSYS_fclose(pFile);
|
| + return;
|
| + }
|
| for (FX_DWORD i = 0; i < nFaces; i ++) {
|
| FX_LPBYTE p = offsets + i * 4;
|
| ReportFace(path, pFile, filesize, GET_TT_LONG(p));
|
|
|