ReceiveTempSMS
/
Al-Qurtas-Islamic-bank-The-Best-Bank-in-Iraq
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix Savannah bug #31310. 

* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against
invalid `runcnt' values.
This commit is contained in:
Werner Lemberg 2010-10-12 07:49:17 +02:00
parent bc4ed48e41
commit 59eb9f8cfe
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2010-10-12 Werner Lemberg <wl@gnu.org>
Fix Savannah bug #31310.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against
invalid `runcnt' values.
2010-10-08 Chris Liddell <chris.liddell@artifex.com> 2010-10-08 Chris Liddell <chris.liddell@artifex.com>
Fix Savannah bug #31275. Fix Savannah bug #31275.

6
src/truetype/ttgxvar.c
View File

@ -130,7 +130,7 @@
FT_Int j; FT_Int j;
FT_Int first; FT_Int first;
FT_Memory memory = stream->memory; FT_Memory memory = stream->memory;
FT_Error error = TT_Err_Ok; FT_Error error = TT_Err_Ok;
FT_UNUSED( error ); FT_UNUSED( error );
@ -154,7 +154,7 @@
runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK;
first = points[i++] = FT_GET_USHORT(); first = points[i++] = FT_GET_USHORT();
if ( runcnt < 1 ) if ( runcnt < 1 || i + runcnt >= n )
goto Exit; goto Exit;
/* first point not included in runcount */ /* first point not included in runcount */
@ -165,7 +165,7 @@
{ {
first = points[i++] = FT_GET_BYTE(); first = points[i++] = FT_GET_BYTE();
if ( runcnt < 1 ) if ( runcnt < 1 || i + runcnt >= n )
goto Exit; goto Exit;
for ( j = 0; j < runcnt; ++j ) for ( j = 0; j < runcnt; ++j )