From 594156586b888805681a7085a780bd743fb180bd Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Tue, 27 Aug 2019 14:07:14 +0200 Subject: [PATCH] [truetype] Prevent crash in `TT_Set_Named_Instance' (#56813). * src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error handling. --- ChangeLog | 7 +++++++ src/truetype/ttgxvar.c | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 7a06ca0a8..04124849f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2019-08-27 Werner Lemberg + + [truetype] Prevent crash in `TT_Set_Named_Instance' (#56813). + + * src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error + handling. + 2019-08-27 Werner Lemberg [woff2] Fix compiler warnings. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 9ce61dff9..df5f9bbb3 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -3037,7 +3037,7 @@ TT_Set_Named_Instance( TT_Face face, FT_UInt instance_index ) { - FT_Error error = FT_ERR( Invalid_Argument ); + FT_Error error; GX_Blend blend; FT_MM_Var* mmvar; @@ -3057,7 +3057,10 @@ /* `instance_index' starts with value 1, thus `>' */ if ( instance_index > num_instances ) + { + error = FT_ERR( Invalid_Argument ); goto Exit; + } if ( instance_index > 0 ) {