mismatch between cffread.c:saveBlend() and cffwrite_dict.c:saveRealBlendOp()

[cjchapman]

In cffread.c:saveBlend() we’re allocating numBlends + numRegions values:

        unsigned short numBlendValues = (unsigned short)(numBlends + numRegions);
        float *blendValues = (float *)memNew(h, sizeof(abfOpEntry) * numBlendValues);

...but in cffwrite_dict.c:saveRealBlendOp() we’re trying to access numBlends * numRegions values:

    for (k = 0; k <= numRegions; k++) {
        int curIndex = (k + 1) * numBlends - 1;
        for (j = 1; j < numBlends; j++) {
            blendValues[curIndex] -= blendValues[curIndex - 1];
            curIndex--;
        }
    }

I thought of changing the allocation in saveBlend() to:

        unsigned short numBlendValues = (unsigned short)(numBlends * numRegions);

...but saveBlend() only writes numRegions values:

        for (i = 0; i < numRegions; i++) {
            blendValues[i + 1] = stackEntry->blend_val[i] + defaultValue;
        }

...so I think there’s some bigger problem here.

Attached are two fuzzed fonts produced by AFL that will cause a crash in saveRealBlendOp() if you build tx with Address Sanitizer and run it with the -cff2 option:
tx_cff2_crashes.zip

[blueshade7]

saveBlend() appears to make certain assumptions about the input for a Private Dict operator expecting one value. There must be one value or when blended, numBlend must be one. Such assumptions maybe broken by fuzzed fonts.