fontselect: add bounds checking for memory font stream reads

diff --git a/libass/ass_fontselect.c b/libass/ass_fontselect.c
index dc143c43c5f3fb57c4e44c00e19bc527f7722d83..02d0bc42d27c3b2a0d8f3a74861f5ea70a7201f9 100644 (file)
--- a/libass/ass_fontselect.c
+++ b/libass/ass_fontselect.c
@@ -145,6 +145,12 @@ get_data_embedded(void *data, unsigned char *buf, size_t offset, size_t len)
     if (buf == NULL)
         return fd[i].size;
 
+    if (offset >= fd[i].size)
+        return 0;
+
+    if (len > fd[i].size - offset)
+        len = fd[i].size - offset;
+
     memcpy(buf, fd[i].data + offset, len);
     return len;
 }