From 59eb9f8cfe7d1df379a2318316d1f04f80fba54a Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Tue, 12 Oct 2010 07:49:17 +0200 Subject: [PATCH] Fix Savannah bug #31310. * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against invalid `runcnt' values. --- ChangeLog | 7 +++++++ src/truetype/ttgxvar.c | 6 +++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index c4f2132bb..fb8085eb5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2010-10-12 Werner Lemberg + + Fix Savannah bug #31310. + + * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against + invalid `runcnt' values. + 2010-10-08 Chris Liddell Fix Savannah bug #31275. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 653d9d5cf..47bb9fcca 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -130,7 +130,7 @@ FT_Int j; FT_Int first; FT_Memory memory = stream->memory; - FT_Error error = TT_Err_Ok; + FT_Error error = TT_Err_Ok; FT_UNUSED( error ); @@ -154,7 +154,7 @@ runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; first = points[i++] = FT_GET_USHORT(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; /* first point not included in runcount */ @@ -165,7 +165,7 @@ { first = points[i++] = FT_GET_BYTE(); - if ( runcnt < 1 ) + if ( runcnt < 1 || i + runcnt >= n ) goto Exit; for ( j = 0; j < runcnt; ++j )