From 2fe272aca62ff925f1f29d81268f2c4629f250da Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Mon, 18 Dec 2017 19:40:07 +0100
Subject: [PATCH] * src/truetype/ttgxvar.c (tt_face_vary_cvt): Add size guard
 (#52688).

---
 ChangeLog              | 4 ++++
 src/truetype/ttgxvar.c | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 9cdb5e531..2ef631b72 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2017-12-18  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgxvar.c (tt_face_vary_cvt): Add size guard (#52688).
+
 2017-12-18  Werner Lemberg  <wl@gnu.org>
 
 	[truetype] Fix previous commit.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 0d4872f4a..221f57206 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -3110,7 +3110,10 @@
                                         table_len,
                                         point_count == 0 ? face->cvt_size
                                                          : point_count );
-      if ( !points || !deltas )
+
+      if ( !points                                                        ||
+           !deltas                                                        ||
+           ( localpoints == ALL_POINTS && point_count != face->cvt_size ) )
         ; /* failure, ignore it */
 
       else if ( localpoints == ALL_POINTS )