diff options
author | wm4 <wm4@nowhere> | 2015-08-31 12:15:01 +0200 |
---|---|---|
committer | wm4 <wm4@nowhere> | 2015-08-31 12:15:01 +0200 |
commit | 28ee420508b3fcfc0c9ba5166ee3365e364be531 (patch) | |
tree | 6f8db1f7f959d8cfd0162e63947efbf27156def2 | |
parent | 3fb044d3d515203cb3c6bdef1760c41dff60b877 (diff) | |
download | libass-28ee420508b3fcfc0c9ba5166ee3365e364be531.tar.bz2 libass-28ee420508b3fcfc0c9ba5166ee3365e364be531.tar.xz |
fontselect: add bounds checking for memory font stream reads
-rw-r--r-- | libass/ass_fontselect.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libass/ass_fontselect.c b/libass/ass_fontselect.c index dc143c4..02d0bc4 100644 --- a/libass/ass_fontselect.c +++ b/libass/ass_fontselect.c @@ -145,6 +145,12 @@ get_data_embedded(void *data, unsigned char *buf, size_t offset, size_t len) if (buf == NULL) return fd[i].size; + if (offset >= fd[i].size) + return 0; + + if (len > fd[i].size - offset) + len = fd[i].size - offset; + memcpy(buf, fd[i].data + offset, len); return len; } |