minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[truetype] More fixes for handling of GX deltas. 

Problems reported by Bob Taylor <Bob.Taylor@monotype.com>.

* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Fix rough
sanity test for glyph variation array header size.
Always set stream position before reading packed x and y deltas.
Fix thinko w.r.t. `localpoints' array.
This commit is contained in:
Werner Lemberg 2016-09-03 18:14:00 +02:00
parent ca8e98d94a
commit 4e659d7ead
2 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2016-09-03 Werner Lemberg <wl@gnu.org>
[truetype] More fixes for handling of GX deltas.
Problems reported by Bob Taylor <Bob.Taylor@monotype.com>.
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Fix rough
sanity test for glyph variation array header size.
Always set stream position before reading packed x and y deltas.
Fix thinko w.r.t. `localpoints' array.
2016-09-03 Werner Lemberg <wl@gnu.org>
[ftrandom] Various fixes.

12
src/truetype/ttgxvar.c
View File

@ -1894,7 +1894,8 @@
offsetToData = FT_GET_USHORT();
/* rough sanity test */
if ( offsetToData + tupleCount * 4 > blend->gvar_size )
if ( offsetToData + ( tupleCount & GX_TC_TUPLE_COUNT_MASK ) * 4 >
blend->gvar_size )
{
FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
" invalid glyph variation array header\n" ));
@ -1979,10 +1980,10 @@
here = FT_Stream_FTell( stream );
FT_Stream_SeekSet( stream, offsetToData );
if ( tupleIndex & GX_TI_PRIVATE_POINT_NUMBERS )
{
FT_Stream_SeekSet( stream, offsetToData );
localpoints = ft_var_readpackedpoints( stream,
blend->gvar_size,
&point_count );
@ -2045,9 +2046,6 @@
#endif
}
else if ( localpoints == NULL )
; /* failure, ignore it */
else
{
#ifdef FT_DEBUG_LEVEL_TRACE
@ -2065,7 +2063,7 @@
for ( j = 0; j < point_count; j++ )
{
FT_UShort idx = localpoints[j];
FT_UShort idx = points[j];
if ( idx >= n_points )