[cff] One more check against malformed font matrix.
* src/cff/cffparse.c (cff_parse_font_matrix): Guard against `xx' and `yy' matrix coefficients being zero.
This commit is contained in:
parent
ba67957d5e
commit
35bb214ae6
|
@ -1,3 +1,10 @@
|
|||
2012-03-03 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
[cff] One more check against malformed font matrix.
|
||||
|
||||
* src/cff/cffparse.c (cff_parse_font_matrix): Guard against `xx' and
|
||||
`yy' matrix coefficients being zero.
|
||||
|
||||
2012-03-03 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
Fix Savannah bug #35660.
|
||||
|
|
|
@ -474,22 +474,11 @@
|
|||
|
||||
if ( scaling < 0 || scaling > 9 )
|
||||
{
|
||||
/* Return default matrix in case of unlikely values. */
|
||||
|
||||
FT_TRACE1(( "cff_parse_font_matrix:"
|
||||
" strange scaling value for xx element (%d),\n"
|
||||
" "
|
||||
" using default matrix\n", scaling ));
|
||||
|
||||
matrix->xx = 0x10000L;
|
||||
matrix->yx = 0;
|
||||
matrix->xy = 0;
|
||||
matrix->yy = 0x10000L;
|
||||
offset->x = 0;
|
||||
offset->y = 0;
|
||||
*upm = 1;
|
||||
|
||||
goto Exit;
|
||||
goto Default_matrix;
|
||||
}
|
||||
|
||||
matrix->yx = cff_parse_fixed_scaled( data++, scaling );
|
||||
|
@ -498,6 +487,13 @@
|
|||
offset->x = cff_parse_fixed_scaled( data++, scaling );
|
||||
offset->y = cff_parse_fixed_scaled( data, scaling );
|
||||
|
||||
if ( matrix->xx == 0 || matrix->yy == 0 )
|
||||
{
|
||||
FT_TRACE1(( "cff_parse_font_matrix:"
|
||||
" xx or yy element is zero, using default matrix\n" ));
|
||||
goto Default_matrix;
|
||||
}
|
||||
|
||||
*upm = power_tens[scaling];
|
||||
|
||||
FT_TRACE4(( " [%f %f %f %f %f %f]\n",
|
||||
|
@ -509,6 +505,17 @@
|
|||
(double)offset->y / *upm / 65536 ));
|
||||
}
|
||||
|
||||
goto Exit;
|
||||
|
||||
Default_matrix:
|
||||
matrix->xx = 0x10000L;
|
||||
matrix->yx = 0;
|
||||
matrix->xy = 0;
|
||||
matrix->yy = 0x10000L;
|
||||
offset->x = 0;
|
||||
offset->y = 0;
|
||||
*upm = 1;
|
||||
|
||||
Exit:
|
||||
return error;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue