Nikolay Sivov : usp10: Ignore device tables with invalid delta format.

[Alexandre Julliard]

Module: wine
Branch: stable
Commit: 179500a7ef2db21f9a20ed06ac3f41765640befb
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=179500a7ef2db21f9a20ed06ac3f41765640befb

Author: Nikolay Sivov <nsivov at codeweavers.com>
Date:   Mon Feb 20 02:36:39 2017 +0300

usp10: Ignore device tables with invalid delta format.

Signed-off-by: Nikolay Sivov <nsivov at codeweavers.com>
Signed-off-by: Aric Stewart <aric at codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard at winehq.org>
(cherry picked from commit fefd15118fa643c16a34be889baf79cda1768a0f)
Signed-off-by: Michael Stefaniuc <mstefani at winehq.org>

---

 dlls/usp10/opentype.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/dlls/usp10/opentype.c b/dlls/usp10/opentype.c
index d7afbe1..d20361e 100644
--- a/dlls/usp10/opentype.c
+++ b/dlls/usp10/opentype.c
@@ -1114,10 +1114,18 @@ static INT GPOS_get_device_table_value(const OT_DeviceTable *DeviceTable, WORD p
     static const WORD mask[3] = {3,0xf,0xff};
     if (DeviceTable && ppem >= GET_BE_WORD(DeviceTable->StartSize) && ppem  <= GET_BE_WORD(DeviceTable->EndSize))
     {
-        int format = GET_BE_WORD(DeviceTable->DeltaFormat);
+        WORD format = GET_BE_WORD(DeviceTable->DeltaFormat);
         int index = ppem - GET_BE_WORD(DeviceTable->StartSize);
         int value;
-        TRACE("device table, format %i, index %i\n",format, index);
+
+        TRACE("device table, format %#x, index %i\n", format, index);
+
+        if (format & ~0x3)
+        {
+            WARN("invalid delta format %#x\n", format);
+            return 0;
+        }
+
         index = index << format;
         value = (DeviceTable->DeltaValue[index/sizeof(WORD)] << (index%sizeof(WORD)))&mask[format-1];
         TRACE("offset %i, value %i\n",index, value);