Harden against some potential overflows

Author: LaurenzV

src/lib.rs

@@ -434,7 +434,7 @@ impl<'a> Face<'a> {
         let i = self.records.binary_search_by(|record| record.tag.cmp(&tag)).ok()?;
         let record = self.records.get(i)?;
         let start = record.offset as usize;
-        let end = start + (record.length as usize);
+        let end = start.checked_add(record.length as usize)?;
         self.data.get(start..end)
     }
 }
@@ -684,4 +684,19 @@ mod tests {
 
         assert_eq!(result, Err(Error::CFFError));
     }
+
+    #[test]
+    fn table_record_with_invalid_bounds_returns_none() {
+        let face = Face {
+            data: &[],
+            records: vec![TableRecord {
+                tag: Tag::HEAD,
+                checksum: 0,
+                offset: u32::MAX,
+                length: u32::MAX,
+            }],
+        };
+
+        assert_eq!(face.table(Tag::HEAD), None);
+    }
 }

src/read.rs

@@ -50,8 +50,9 @@ impl<'a> Reader<'a> {
     /// Read a certain number of bytes.
     #[inline]
     pub fn read_bytes(&mut self, len: usize) -> Option<&'a [u8]> {
-        let v = self.data.get(self.offset..self.offset + len)?;
-        self.offset += len;
+        let end = self.offset.checked_add(len)?;
+        let v = self.data.get(self.offset..end)?;
+        self.offset = end;
         Some(v)
     }