rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Really fix `hintmask' and `cntrmask' limit check. 

* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Fix thinko and handle tracing also.
This commit is contained in:
Werner Lemberg 2010-06-27 15:41:02 +02:00
parent 8bebaa74cc
commit 18b552f6ae
2 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2010-06-27 Werner Lemberg <wl@gnu.org>
[cff] Really fix `hintmask' and `cntrmask' limit check.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Fix thinko and handle tracing also.
2010-06-27 Werner Lemberg <wl@gnu.org>
Fix valgrind warning.

18
src/cff/cffgload.c
View File

@ -1339,16 +1339,16 @@
decoder->num_hints += num_args / 2;
}
/* In a valid charstring there must be at least three bytes */
/* after `hintmask' or `cntrmask' (two for a `moveto' */
/* operator and one for `endchar'). Additionally, there */
/* must be space for `num_hints' bits. */
if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
goto Syntax_Error;
if ( hinter )
{
/* In a valid charstring there must be at least three bytes */
/* after `hintmask' or `cntrmask' (two for a `moveto' */
/* operator and one for `endchar'). Additionally, there */
/* must be space for `num_hints' bits. */
if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
goto Syntax_Error;
if ( op == cff_op_hintmask )
hinter->hintmask( hinter->hints,
builder->current->n_points,
@ -1377,8 +1377,6 @@
#else
ip += ( decoder->num_hints + 7 ) >> 3;
#endif
if ( ip >= limit )
goto Syntax_Error;
args = stack;
break;