[Git][freetype/freetype][master] * src/truetype/ttgxvar.c (tt_set_mm_blend): Test `coords`.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• d3dc2da9
  by Ben Wagner at 2021-07-01T07:02:04+02:00

  * src/truetype/ttgxvar.c (tt_set_mm_blend): Test `coords`.
  
  It is undefined behavior to pass `NULL` to `memcpy`.  `coords' is
  passed to `memcpy` but `TT_Get_MM_Blend` and `TT_Get_Var_Design`
  explictly call `tt_set_mm_blend` with `coords` as `NULL`.  In
  addition, `TT_Set_MM_Blend` has a similar possible issue.
  

2 changed files:

• ChangeLog
• src/truetype/ttgxvar.c

Changes:

ChangeLog

---

	1	+2021-07-01 Ben Wagner <bungeman@chromium.org>
	2	+
	3	+ * src/truetype/ttgxvar.c (tt_set_mm_blend): Test `coords`.
	4	+
	5	+ It is undefined behavior to pass `NULL` to `memcpy`. `coords' is
	6	+ passed to `memcpy` but `TT_Get_MM_Blend` and `TT_Get_Var_Design`
	7	+ explictly call `tt_set_mm_blend` with `coords` as `NULL`. In
	8	+ addition, `TT_Set_MM_Blend` has a similar possible issue.
	9	+
1	10	2021-06-30 Dominik Röttsches <drott@chromium.org>
2	11
3	12	[sfnt] Support PaintScale in 'COLR' v1 parsing.

src/truetype/ttgxvar.c

---

...	...	@@ -2663,9 +2663,10 @@
2663	2663	}
2664	2664
2665	2665	blend->num_axis = mmvar->num_axis;
2666		- FT_MEM_COPY( blend->normalizedcoords,
2667		- coords,
2668		- num_coords * sizeof ( FT_Fixed ) );
	2666	+ if ( coords )
	2667	+ FT_MEM_COPY( blend->normalizedcoords,
	2668	+ coords,
	2669	+ num_coords * sizeof ( FT_Fixed ) );
2669	2670
2670	2671	if ( set_design_coords )
2671	2672	ft_var_to_design( face,

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.