From 29c759284e305ec428703c9a5831d0b1fc3497ef Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 27 Jan 2018 14:43:43 +0100 Subject: * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL reference. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 --- ChangeLog | 8 ++++++++ src/truetype/ttinterp.c | 12 ++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 15ef4ae31..fff4a4141 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2018-01-27 Werner Lemberg + + * src/truetype/ttinterp.c (Ins_GETVARIATION): Avoid NULL reference. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 + 2018-01-27 Werner Lemberg * src/truetype/ttgxvar.c (tt_set_mm_blend): Minor. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index d855aaaa9..551f14a2e 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -7532,8 +7532,16 @@ return; } - for ( i = 0; i < num_axes; i++ ) - args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ + if ( coords ) + { + for ( i = 0; i < num_axes; i++ ) + args[i] = coords[i] >> 2; /* convert 16.16 to 2.14 format */ + } + else + { + for ( i = 0; i < num_axes; i++ ) + args[i] = 0; + } } -- cgit v1.2.3