diff --git a/ChangeLog b/ChangeLog index 775201abc..d8f446bf9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2016-12-24 Werner Lemberg + + * src/truetype/ttpload.c (tt_face_load_hdmx): Ignore `version'. + + Problem reported by 張俊芝 <418092625@qq.com>. + 2016-12-24 Werner Lemberg * src/sfnt/ttsbit.c (tt_face_load_sbit): Allow more version values. diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index 95ab47017..d756d3842 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -524,7 +524,7 @@ { FT_Error error; FT_Memory memory = stream->memory; - FT_UInt version, nn, num_records; + FT_UInt nn, num_records; FT_ULong table_size, record_size; FT_Byte* p; FT_Byte* limit; @@ -541,7 +541,10 @@ p = face->hdmx_table; limit = p + table_size; - version = FT_NEXT_USHORT( p ); + /* Given that `hdmx' tables are losing its importance (for example, */ + /* variation fonts introduced in OpenType 1.8 must not have this */ + /* table) we no longer test for a correct `version' field. */ + p += 2; num_records = FT_NEXT_USHORT( p ); record_size = FT_NEXT_ULONG( p ); @@ -560,8 +563,7 @@ record_size &= 0xFFFFU; /* The limit for `num_records' is a heuristic value. */ - if ( version != 0 || - num_records > 255 || + if ( num_records > 255 || ( num_records > 0 && ( record_size > 0x10001L || record_size < 4 ) ) )