From ec4372f56552b7370d6693db8b4d44d412e2dd6a Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Thu, 18 Nov 2010 20:34:22 +0100 Subject: [PATCH] [truetype] Fix `loca' handling for inconsistent number of glyphs. Reported by Johnson Y. Yan . * src/truetype/ttpload.c (tt_face_load_loca): While sanitizing, handle case where `loca' is the last table in the font. --- ChangeLog | 8 ++++++++ src/truetype/ttpload.c | 10 ++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 10d4631fd..2b292adca 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2010-11-18 Werner Lemberg + + [truetype] Fix `loca' handling for inconsistent number of glyphs. + Reported by Johnson Y. Yan . + + * src/truetype/ttpload.c (tt_face_load_loca): While sanitizing, + handle case where `loca' is the last table in the font. + 2010-11-18 Werner Lemberg [sfnt] Ignore all errors while loading `OS/2' table. diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index c53173359..68a545315 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -4,7 +4,7 @@ /* */ /* TrueType-specific tables loader (body). */ /* */ -/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by */ +/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -137,6 +137,12 @@ dist = diff; } + if ( entry == limit ) + { + /* `loca' is the last table */ + dist = stream->size - pos; + } + if ( new_loca_len <= dist ) { face->num_locations = face->root.num_glyphs; @@ -307,7 +313,7 @@ FT_Short* limit = cur + face->cvt_size; - for ( ; cur < limit; cur++ ) + for ( ; cur < limit; cur++ ) *cur = FT_GET_SHORT(); }