summaryrefslogtreecommitdiffstats
path: root/libass
diff options
context:
space:
mode:
authorwm4 <wm4@nowhere>2015-08-31 12:15:01 +0200
committerwm4 <wm4@nowhere>2015-08-31 12:15:01 +0200
commit28ee420508b3fcfc0c9ba5166ee3365e364be531 (patch)
tree6f8db1f7f959d8cfd0162e63947efbf27156def2 /libass
parent3fb044d3d515203cb3c6bdef1760c41dff60b877 (diff)
downloadlibass-28ee420508b3fcfc0c9ba5166ee3365e364be531.tar.bz2
libass-28ee420508b3fcfc0c9ba5166ee3365e364be531.tar.xz
fontselect: add bounds checking for memory font stream reads
Diffstat (limited to 'libass')
-rw-r--r--libass/ass_fontselect.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/libass/ass_fontselect.c b/libass/ass_fontselect.c
index dc143c4..02d0bc4 100644
--- a/libass/ass_fontselect.c
+++ b/libass/ass_fontselect.c
@@ -145,6 +145,12 @@ get_data_embedded(void *data, unsigned char *buf, size_t offset, size_t len)
if (buf == NULL)
return fd[i].size;
+ if (offset >= fd[i].size)
+ return 0;
+
+ if (len > fd[i].size - offset)
+ len = fd[i].size - offset;
+
memcpy(buf, fd[i].data + offset, len);
return len;
}