ReceiveTempSMS
/
Al-Qurtas-Islamic-bank-The-Best-Bank-in-Iraq
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Fix `loca' handling for inconsistent number of glyphs. 

Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>.

* src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
handle case where `loca' is the last table in the font.
This commit is contained in:
Werner Lemberg 2010-11-18 20:34:22 +01:00
parent fa764cf868
commit ec4372f565
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2010-11-18 Werner Lemberg <wl@gnu.org>
[truetype] Fix `loca' handling for inconsistent number of glyphs.
Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>.
* src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
handle case where `loca' is the last table in the font.
2010-11-18 Werner Lemberg <wl@gnu.org> 2010-11-18 Werner Lemberg <wl@gnu.org>
[sfnt] Ignore all errors while loading `OS/2' table. [sfnt] Ignore all errors while loading `OS/2' table.

10
src/truetype/ttpload.c
View File

@ -4,7 +4,7 @@
/* */ /* */
/* TrueType-specific tables loader (body). */ /* TrueType-specific tables loader (body). */
/* */ /* */
/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by */ /* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */ /* */
/* This file is part of the FreeType project, and may only be used, */ /* This file is part of the FreeType project, and may only be used, */
@ -137,6 +137,12 @@
dist = diff; dist = diff;
} }
if ( entry == limit )
{
/* `loca' is the last table */
dist = stream->size - pos;
}
if ( new_loca_len <= dist ) if ( new_loca_len <= dist )
{ {
face->num_locations = face->root.num_glyphs; face->num_locations = face->root.num_glyphs;
@ -307,7 +313,7 @@
FT_Short* limit = cur + face->cvt_size; FT_Short* limit = cur + face->cvt_size;
for ( ; cur < limit; cur++ ) for ( ; cur < limit; cur++ )
*cur = FT_GET_SHORT(); *cur = FT_GET_SHORT();
} }