[cff] Really fix `hintmask' and `cntrmask' limit check.
* src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_hintmask>: Fix thinko and handle tracing also.
This commit is contained in:
parent
8bebaa74cc
commit
18b552f6ae
|
@ -1,3 +1,10 @@
|
||||||
|
2010-06-27 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
[cff] Really fix `hintmask' and `cntrmask' limit check.
|
||||||
|
|
||||||
|
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
|
||||||
|
<cff_op_hintmask>: Fix thinko and handle tracing also.
|
||||||
|
|
||||||
2010-06-27 Werner Lemberg <wl@gnu.org>
|
2010-06-27 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
Fix valgrind warning.
|
Fix valgrind warning.
|
||||||
|
|
|
@ -1339,16 +1339,16 @@
|
||||||
decoder->num_hints += num_args / 2;
|
decoder->num_hints += num_args / 2;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/* In a valid charstring there must be at least three bytes */
|
||||||
|
/* after `hintmask' or `cntrmask' (two for a `moveto' */
|
||||||
|
/* operator and one for `endchar'). Additionally, there */
|
||||||
|
/* must be space for `num_hints' bits. */
|
||||||
|
|
||||||
|
if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
|
||||||
|
goto Syntax_Error;
|
||||||
|
|
||||||
if ( hinter )
|
if ( hinter )
|
||||||
{
|
{
|
||||||
/* In a valid charstring there must be at least three bytes */
|
|
||||||
/* after `hintmask' or `cntrmask' (two for a `moveto' */
|
|
||||||
/* operator and one for `endchar'). Additionally, there */
|
|
||||||
/* must be space for `num_hints' bits. */
|
|
||||||
|
|
||||||
if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
|
|
||||||
goto Syntax_Error;
|
|
||||||
|
|
||||||
if ( op == cff_op_hintmask )
|
if ( op == cff_op_hintmask )
|
||||||
hinter->hintmask( hinter->hints,
|
hinter->hintmask( hinter->hints,
|
||||||
builder->current->n_points,
|
builder->current->n_points,
|
||||||
|
@ -1377,8 +1377,6 @@
|
||||||
#else
|
#else
|
||||||
ip += ( decoder->num_hints + 7 ) >> 3;
|
ip += ( decoder->num_hints + 7 ) >> 3;
|
||||||
#endif
|
#endif
|
||||||
if ( ip >= limit )
|
|
||||||
goto Syntax_Error;
|
|
||||||
args = stack;
|
args = stack;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue