diff --git a/ChangeLog b/ChangeLog index 39775fee3..3132d3935 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2010-06-24 Werner Lemberg <wl@gnu.org> + + Fix Savannah bug #30235. + + * src/pfr/pfrgload.c (pfr_glyph_load_simple): Protect against + invalid indices if there aren't any coordinates for indexing. + 2010-06-24 Werner Lemberg <wl@gnu.org> [bdf]: Font properties are optional. diff --git a/src/pfr/pfrgload.c b/src/pfr/pfrgload.c index 4bf9e74b8..b794722d2 100644 --- a/src/pfr/pfrgload.c +++ b/src/pfr/pfrgload.c @@ -388,7 +388,7 @@ case 2: /* horizontal line to */ FT_TRACE6(( "- horizontal line to cx.%d", format_low )); - if ( format_low > x_count ) + if ( format_low > x_count || x_count == 0 ) goto Failure; pos[0].x = glyph->x_control[format_low]; pos[0].y = pos[3].y; @@ -398,7 +398,7 @@ case 3: /* vertical line to */ FT_TRACE6(( "- vertical line to cy.%d", format_low )); - if ( format_low > y_count ) + if ( format_low > y_count || y_count == 0 ) goto Failure; pos[0].x = pos[3].x; pos[0].y = glyph->y_control[format_low]; @@ -440,7 +440,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > x_count ) + if ( idx > x_count || x_count == 0 ) goto Failure; cur->x = glyph->x_control[idx]; FT_TRACE7(( " cx#%d", idx )); @@ -470,7 +470,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > y_count ) + if ( idx > y_count || y_count == 0 ) goto Failure; cur->y = glyph->y_control[idx]; FT_TRACE7(( " cy#%d", idx ));