tree e7af446dbcd4b726a527641e7bced6434f43b9aa
parent a66eb6448b8d7557efb0c974c8d4d72085371c58
author Nigel Tao <nigeltao@golang.org> 1635310406 +1100
committer Nigel Tao <nigeltao@golang.org> 1635452745 +0000

font/sfnt: verify the total number of contour points

The SFNT file format explicitly lists the number of points in each
simple (non-compound) glyph and, in this package, this is loaded in func
loadGlyf as the numPoints variable. numPoints is then passed to func
findXYIndexes to verify that the (variable length) remaning glyph data
has content for that many points. loadGlyf then uses a glyfIter to
iterate over those points, but prior to this commit, fails to enforce
that the glyfIter also honors numPoints when walking each contour of a
glyph. This can lead to a panic (slice index out of bounds) on a
malformed SFNT file, if glyfIter then tries to walk too many points.

Fixes golang/go#48006

Change-Id: I92530e570eb37ce0087927ca23060acebe0a7705
Reviewed-on: https://go-review.googlesource.com/c/image/+/358994
Reviewed-by: Andrew Gerrand <adg@golang.org>
Trust: Nigel Tao <nigeltao@golang.org>