diff --git a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp index 8b9d8f8beda..483f720e5ad 100644 --- a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp +++ b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables.cpp @@ -54,6 +54,10 @@ void MorphTableHeader::process(const LETableReference &base, LEGlyphStorage &gly for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain += 1) { if (chain > 0) { le_uint32 chainLength = SWAPL(chainHeader->chainLength); + if (chainLength & 0x03) { // incorrect alignment for 32 bit tables + success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any + return; + } chainHeader.addOffset(chainLength, success); } FeatureFlags defaultFlags = SWAPL(chainHeader->defaultFlags); @@ -66,6 +70,10 @@ void MorphTableHeader::process(const LETableReference &base, LEGlyphStorage &gly for (subtable = 0; LE_SUCCESS(success) && (subtable < nSubtables); subtable += 1) { if (subtable > 0) { le_int16 length = SWAPW(subtableHeader->length); + if (length & 0x03) { // incorrect alignment for 32 bit tables + success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any + return; + } subtableHeader.addOffset(length, success); } SubtableCoverage coverage = SWAPW(subtableHeader->coverage); diff --git a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp index b75ca85a0ce..33cbdeea740 100644 --- a/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp +++ b/jdk/src/java.desktop/share/native/libfontmanager/layout/MorphTables2.cpp @@ -59,6 +59,10 @@ void MorphTableHeader2::process(const LEReferenceTo &base, LE for (chain = 0; LE_SUCCESS(success) && (chain < chainCount); chain++) { if (chain>0) { le_uint32 chainLength = SWAPL(chainHeader->chainLength); + if (chainLength & 0x03) { // incorrect alignment for 32 bit tables + success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any + return; + } chainHeader.addOffset(chainLength, success); // Don't increment the first time } FeatureFlags flag = SWAPL(chainHeader->defaultFlags); @@ -188,6 +192,10 @@ void MorphTableHeader2::process(const LEReferenceTo &base, LE for (subtable = 0; LE_SUCCESS(success) && subtable < nSubtables; subtable++) { if(subtable>0) { le_uint32 length = SWAPL(subtableHeader->length); + if (length & 0x03) { // incorrect alignment for 32 bit tables + success = LE_MEMORY_ALLOCATION_ERROR; // as good a choice as any + return; + } subtableHeader.addOffset(length, success); // Don't addOffset for the last entry. } le_uint32 coverage = SWAPL(subtableHeader->coverage);