* src/base/ftutil.c (ft_mem_qrealloc): fix the function
to accept 'item_size == 0' as well, though this sounds weird, it can theorically happen. see bug #16669
This commit is contained in:
parent
0971735dce
commit
ea4547ca03
|
@ -1,5 +1,11 @@
|
|||
2006-06-04 David Turner <david@freetype.org>
|
||||
|
||||
* src/base/ftutil.c (ft_mem_qrealloc): fix the function
|
||||
to accept 'item_size == 0' as well, though this sounds
|
||||
weird, it can theorically happen.
|
||||
|
||||
see bug #16669
|
||||
|
||||
* src/pfr/pfrobjs.c (pfr_face_init): fix the computation
|
||||
of 'face->num_glyphs' which missed the last glyph, due to
|
||||
the offset-by-1 computation, since the PFR format doesn't
|
||||
|
|
|
@ -120,12 +120,16 @@
|
|||
FT_Error error = FT_Err_Ok;
|
||||
|
||||
|
||||
if ( cur_count < 0 || new_count < 0 || item_size <= 0 )
|
||||
/* note that we now accept item_size == 0 as a valid
|
||||
* parameter. this in order to cover very weird cases
|
||||
* where a ALLOC_MULT macro would be called
|
||||
*/
|
||||
if ( cur_count < 0 || new_count < 0 || item_size < 0 )
|
||||
{
|
||||
/* may help catch/prevent nasty security issues */
|
||||
error = FT_Err_Invalid_Argument;
|
||||
}
|
||||
else if ( new_count == 0 )
|
||||
else if ( new_count == 0 || item_size == 0 )
|
||||
{
|
||||
ft_mem_free( memory, block );
|
||||
block = NULL;
|
||||
|
|
Loading…
Reference in New Issue