Source code
Revision control
Copy as Markdown
Other Tools
diff --git a/src/variations.cc b/src/variations.cc
--- a/src/variations.cc
+++ b/src/variations.cc
@@ -92,7 +92,14 @@
}
}
- if (!subtable.Skip(valueSize * size_t(itemCount) * (size_t(wordDeltaCount) + size_t(*regionIndexCount)))) {
+ // The individual counts here are 16-bit values, and valueSize is either 1 or 2,
+ // so this cannot overflow.
+ size_t deltaSetSize = valueSize * (size_t(wordDeltaCount) + size_t(*regionIndexCount));
+ // Check that multiplication by itemCount will not overflow size_t.
+ if (itemCount && deltaSetSize > std::numeric_limits<size_t>::max() / itemCount) {
+ return OTS_FAILURE_MSG("Delta data size overflow");
+ }
+ if (!subtable.Skip(deltaSetSize * size_t(itemCount))) {
return OTS_FAILURE_MSG("Failed to read delta data");
}