diff --git a/ChangeLog b/ChangeLog index 2a102390d..bb9d8dc7f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2010-02-12 suzuki toshiya + + Fix overallocating bug in FT_Outline_New_Internal(). + + * src/base/ftoutln.c (FT_Outline_New_Internal): The length of + FT_Outline->points[] should be numPoints, not 2 * numPoints. + Found by Paul Messmer, see + http://lists.gnu.org/archive/html/freetype-devel/2010-02/msg00003.html + 2010-02-10 Ken Sharp Really fix Savannah bug #28678 (part 2). diff --git a/src/base/ftoutln.c b/src/base/ftoutln.c index 49ef82e27..db76b8b6c 100644 --- a/src/base/ftoutln.c +++ b/src/base/ftoutln.c @@ -304,9 +304,9 @@ *anoutline = null_outline; - if ( FT_NEW_ARRAY( anoutline->points, numPoints * 2L ) || - FT_NEW_ARRAY( anoutline->tags, numPoints ) || - FT_NEW_ARRAY( anoutline->contours, numContours ) ) + if ( FT_NEW_ARRAY( anoutline->points, numPoints ) || + FT_NEW_ARRAY( anoutline->tags, numPoints ) || + FT_NEW_ARRAY( anoutline->contours, numContours ) ) goto Fail; anoutline->n_points = (FT_UShort)numPoints;