minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

Formatting.

This commit is contained in:
Werner Lemberg 2009-03-03 23:34:49 +00:00
parent ab7e52b1c7
commit 42f5c714c0
3 changed files with 16 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,11 +1,12 @@
2009-03-03 David Turner <david@freetype.org>
Fix SFNT kerning table parser against malformed tables.
Closes Savannah BUG #25750
Protect SFNT kerning table parser against malformed tables.
* src/sfnt/ttkern.c (tt_face_get_kerning): fix a bug
where a malformed table would be succesfully loaded but
later crash the engine during parsing.
This closes Savannah BUG #25750.
* src/sfnt/ttkern.c (tt_face_load_kern, tt_face_get_kerning): Fix a
bug where a malformed table would be successfully loaded but later
crash the engine during parsing.
2009-03-03 David Turner <david@freetype.org>

4
docs/CHANGES
View File

@ -33,8 +33,8 @@ CHANGES BETWEEN 2.3.9 and 2.3.8
- `FT_Get_Advance' (and `FT_Get_Advances') returned bad values for
almost all font formats except TrueType fonts.
- Fix a bug in the SFNT kerning table loader/parser which could crash
the engine if certain malformed tables were encountered.
- Fix a bug in the SFNT kerning table loader/parser which could
crash the engine if certain malformed tables were encountered.
II. IMPORTANT CHANGES

16
src/sfnt/ttkern.c
View File

@ -5,7 +5,7 @@
/* Load the basic TrueType kerning table. This doesn't handle */
/* kerning data within the GPOS table at the moment. */
/* */
/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007 by */
/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@ -103,8 +103,8 @@
p_next += length;
if (p_next > p_limit) /* handle broken table */
p_next = p_limit;
if ( p_next > p_limit ) /* handle broken table */
p_next = p_limit;
/* only use horizontal kerning tables */
if ( ( coverage & ~8 ) != 0x0001 ||
@ -114,8 +114,8 @@
num_pairs = FT_NEXT_USHORT( p );
p += 6;
if ( (p_next - p)/6 < (int)num_pairs ) /* handle broken count */
num_pairs = (FT_UInt)((p_next - p)/6);
if ( ( p_next - p ) / 6 < (int)num_pairs ) /* handle broken count */
num_pairs = (FT_UInt)( ( p_next - p ) / 6 );
avail |= mask;
@ -207,7 +207,7 @@
next = base + length;
if (next > p_limit) /* handle broken table */
if ( next > p_limit ) /* handle broken table */
next = p_limit;
if ( ( face->kern_avail_bits & mask ) == 0 )
@ -219,8 +219,8 @@
num_pairs = FT_NEXT_USHORT( p );
p += 6;
if ((next - p)/6 < (int)num_pairs) /* handle broken count */
num_pairs = (FT_UInt)((next - p)/6);
if ( ( next - p ) / 6 < (int)num_pairs ) /* handle broken count */
num_pairs = (FT_UInt)( ( next - p ) / 6 );
switch ( coverage >> 8 )
{