From e1b438bb1ab2e49a7a472a71efa5e2d32c4829e6 Mon Sep 17 00:00:00 2001 From: Idan Horowitz Date: Sat, 2 Dec 2023 11:51:51 +0200 Subject: [PATCH] LibGfx: Actually ensure Cmap subtable offset is within expected range Our previous check was not sufficient, since it merely checked the first byte of the EncodingRecord offset is within range, while the actual read is 4-byte wide. Fixes ossfuzz-64165. --- Userland/Libraries/LibGfx/Font/OpenType/Cmap.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Userland/Libraries/LibGfx/Font/OpenType/Cmap.cpp b/Userland/Libraries/LibGfx/Font/OpenType/Cmap.cpp index fff80e0600..e88f33750b 100644 --- a/Userland/Libraries/LibGfx/Font/OpenType/Cmap.cpp +++ b/Userland/Libraries/LibGfx/Font/OpenType/Cmap.cpp @@ -68,7 +68,7 @@ Optional Cmap::subtable(u32 index) const return {}; } u32 record_offset = (u32)Sizes::TableHeader + index * (u32)Sizes::EncodingRecord; - if (record_offset + (u32)Offsets::EncodingRecord_Offset >= m_slice.size()) + if (record_offset + (u32)Offsets::EncodingRecord_Offset + sizeof(u32) > m_slice.size()) return {}; u16 platform_id = be_u16(m_slice.offset(record_offset)); u16 encoding_id = be_u16(m_slice.offset(record_offset + (u32)Offsets::EncodingRecord_EncodingID));