From b43e0f4413b2aafb88be8cb3fb7aaa84ac0b9102 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 17 Mar 2012 07:42:43 +0100 Subject: [PATCH] [type1] Fix Savannah bug #35847. * src/type1/t1load.c (parse_subrs): Fix the loop exit condition; we want to exit when we have run out of data. --- ChangeLog | 9 ++++++++- src/type1/t1load.c | 7 ++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3f5061f6..9be6c0728 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,13 @@ +2012-03-17 Chris Liddell + + [type1] Fix Savannah bug #35847. + + * src/type1/t1load.c (parse_subrs): Fix the loop exit condition; + we want to exit when we have run out of data. + 2012-03-16 Werner Lemberg - [bdf] Really fix 35658. + [bdf] Really fix Savannah bug #35658. * src/bdf/bdflib.c (_bdf_list_split): Add one more `field' initializer. diff --git a/src/type1/t1load.c b/src/type1/t1load.c index 4385417a4..5803fde4e 100644 --- a/src/type1/t1load.c +++ b/src/type1/t1load.c @@ -1399,9 +1399,10 @@ FT_Byte* base; - /* If the next token isn't `dup' we are done. */ - if ( parser->root.cursor + 4 < parser->root.limit && - ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 ) + /* If we are out of data, or if the next token isn't `dup', */ + /* we are done. */ + if ( parser->root.cursor + 4 >= parser->root.limit || + ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 ) break; T1_Skip_PS_Token( parser ); /* `dup' */