diff --git a/ChangeLog b/ChangeLog index 1f59d1118..4118d2b1d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,11 @@ 2006-06-04 David Turner + * src/base/ftutil.c (ft_mem_qrealloc): fix the function + to accept 'item_size == 0' as well, though this sounds + weird, it can theorically happen. + + see bug #16669 + * src/pfr/pfrobjs.c (pfr_face_init): fix the computation of 'face->num_glyphs' which missed the last glyph, due to the offset-by-1 computation, since the PFR format doesn't diff --git a/src/base/ftutil.c b/src/base/ftutil.c index 7ad780d38..6331969c5 100644 --- a/src/base/ftutil.c +++ b/src/base/ftutil.c @@ -120,12 +120,16 @@ FT_Error error = FT_Err_Ok; - if ( cur_count < 0 || new_count < 0 || item_size <= 0 ) + /* note that we now accept item_size == 0 as a valid + * parameter. this in order to cover very weird cases + * where a ALLOC_MULT macro would be called + */ + if ( cur_count < 0 || new_count < 0 || item_size < 0 ) { /* may help catch/prevent nasty security issues */ error = FT_Err_Invalid_Argument; } - else if ( new_count == 0 ) + else if ( new_count == 0 || item_size == 0 ) { ft_mem_free( memory, block ); block = NULL;