[Ming-cvs] [libming/libming] 3120f1: Fix NULL pointer deref in outputSWF_TEXT_RECORD

[GitHub <no...@gi...>]

  Branch: refs/heads/master
  Home:   https://github.com/libming/libming
  Commit: 3120f1cdae0c5232a4fb15e5ce42b8c455b43379
      https://github.com/libming/libming/commit/3120f1cdae0c5232a4fb15e5ce42b8c455b43379
  Author: Hugo Lefeuvre <hl...@de...>
  Date:   2018-01-27 (Sat, 27 Jan 2018)

  Changed paths:
    M NEWS
    M util/outputscript.c

  Log Message:
  -----------
  Fix NULL pointer deref in outputSWF_TEXT_RECORD

In outputSWF_TEXT_RECORD, the array offset is stored in a
signed int, while (&(trec->GlyphEntries[i]))->GlyphIndex[0]
returns an unsigned 32 bit number.

This may lead to an integer overflow when reading the offset
from the GlyphIndex array, and further to a buffer overflow
when doing buffer[i]=fi->fontcodeptr[off] with negative off.

In this commit, we change the type of off to unsigned long so
we are guaranteed to be able to store 32 unsigned integers.

This commit fixes CVE-2018-6315 (fixes #101).