[freetype2] master 99f23d6: * src/sfnt/sfwoff2.c (woff2_open_font): Check table index.

[Werner LEMBERG]

branch: master
commit 99f23d6ff2203966d210bccd49eacc62a20328f9
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/sfnt/sfwoff2.c (woff2_open_font): Check table index.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17100
---
 ChangeLog          | 8 ++++++++
 src/sfnt/sfwoff2.c | 7 +++++++
 2 files changed, 15 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 39ce8c0..03292f1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-09-17  Werner Lemberg  <address@hidden>
+
+       * src/sfnt/sfwoff2.c (woff2_open_font): Check table index.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17100
+
 2019-09-15  Avi Halachmi (:avih)  <address@hidden>
 
        [cmake] Don't fail if brotli is missing (#56894).
diff --git a/src/sfnt/sfwoff2.c b/src/sfnt/sfwoff2.c
index 9beb01f..bea73c3 100644
--- a/src/sfnt/sfwoff2.c
+++ b/src/sfnt/sfwoff2.c
@@ -1975,6 +1975,13 @@
             goto Exit;
 
           FT_TRACE6(( "%hu ", table_index ));
+          if ( table_index >= woff2.num_tables )
+          {
+            FT_ERROR(( "woff2_open_font: invalid table index\n" ));
+            error = FT_THROW( Invalid_Table );
+            goto Exit;
+          }
+
           ttc_font->table_indices[j] = table_index;
 
           table = indices[table_index];