From ddf38726996d2293ea11f6f322ae5abb9049fbed Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Thu, 27 Oct 2016 07:27:27 +0200
Subject: [PATCH] [truetype] Fix commit from 2014-11-24.

Problem reported by Hin-Tak Leung  <htl10@users.sourceforge.net>.

* src/truetype/ttpload.c (tt_face_load_hdmx): Fix file checking
logic.
---
 ChangeLog              | 9 +++++++++
 src/truetype/ttpload.c | 9 +++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 54bc4e142..da074a78c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2016-10-27  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Fix commit from 2014-11-24.
+
+	Problem reported by Hin-Tak Leung  <htl10@users.sourceforge.net>.
+
+	* src/truetype/ttpload.c (tt_face_load_hdmx): Fix file checking
+	logic.
+
 2016-10-26  Werner Lemberg  <wl@gnu.org>
 
 	Add `FT_Get_{MM,Var}_Blend_Coordinates' functions.
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c
index c84c18e5d..cd1d27c0d 100644
--- a/src/truetype/ttpload.c
+++ b/src/truetype/ttpload.c
@@ -563,10 +563,11 @@
       record_size &= 0xFFFFU;
 
     /* The limit for `num_records' is a heuristic value. */
-    if ( version != 0           ||
-         num_records > 255      ||
-         record_size > 0x10001L ||
-         record_size < 4        )
+    if ( version != 0                   ||
+         num_records > 255              ||
+         ( num_records > 0            &&
+           ( record_size > 0x10001L ||
+             record_size < 4        ) ) )
     {
       error = FT_THROW( Invalid_File_Format );
       goto Fail;