Skip to content

Commit

Permalink
[ot-font] Fix hmtx wrong table length check
Browse files Browse the repository at this point in the history
Discovered by libFuzzer.  Ouch!

#139 (comment)
  • Loading branch information
behdad committed Oct 15, 2015
1 parent 613e630 commit 63ef0b4
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/hb-ot-font.cc
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ struct hb_ot_face_metrics_accelerator_t

this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag));
if (unlikely (!this->num_advances ||
2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob)))
2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
{
this->num_metrics = this->num_advances = 0;
hb_blob_destroy (this->blob);
Expand Down

0 comments on commit 63ef0b4

Please sign in to comment.