contrib/sdk/sources/freetype/src/sfnt/ttsbit.c: (tt_sbit_decoder_init): Protect against addition and multiplication overflow.

2025-12-22 04:12:27 +07:00
1 changed files with 5 additions and 3 deletions
--- a/contrib/sdk/sources/freetype/src/sfnt/ttsbit.c
+++ b/contrib/sdk/sources/freetype/src/sfnt/ttsbit.c
@@ -234,9 +234,11 @@
      p                          += 34;
      decoder->bit_depth          = *p;

-      if ( decoder->strike_index_array > face->sbit_table_size             ||
-           decoder->strike_index_array + 8 * decoder->strike_index_count >
-             face->sbit_table_size                                         )
+      /* decoder->strike_index_array +                               */
+      /*   8 * decoder->strike_index_count > face->sbit_table_size ? */
+      if ( decoder->strike_index_array > face->sbit_table_size           ||
+           decoder->strike_index_count >
+             ( face->sbit_table_size - decoder->strike_index_array ) / 8 )
        error = FT_THROW( Invalid_File_Format );
    }