Files
Henrik Rydgård 04d8613d81 Bounds-check charPtr inside PGF::ReadCharGlyph
ReadCharGlyph read glyph metadata at an attacker-controlled bit offset
with no validation, and ReadShadowGlyph only checked after delegating to
it. Validate charPtr (with margin for the header reads) at the top of
ReadCharGlyph so it is safe regardless of caller, and drop the now
redundant checks at the ReadPtr call sites.
2026-08-01 11:57:27 +02:00
..