From 3cf87f4d278c7ae5ae91f13936ea076a5a57e2bb Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Thu, 24 Jun 2010 08:20:56 +0200 Subject: [PATCH] Fix Savannah bug #30235. * src/pfr/pfrgload.c (pfr_glyph_load_simple): Protect against invalid indices if there aren't any coordinates for indexing. --- ChangeLog | 7 +++++++ src/pfr/pfrgload.c | 8 ++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 39775fee3..3132d3935 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2010-06-24 Werner Lemberg + + Fix Savannah bug #30235. + + * src/pfr/pfrgload.c (pfr_glyph_load_simple): Protect against + invalid indices if there aren't any coordinates for indexing. + 2010-06-24 Werner Lemberg [bdf]: Font properties are optional. diff --git a/src/pfr/pfrgload.c b/src/pfr/pfrgload.c index 4bf9e74b8..b794722d2 100644 --- a/src/pfr/pfrgload.c +++ b/src/pfr/pfrgload.c @@ -388,7 +388,7 @@ case 2: /* horizontal line to */ FT_TRACE6(( "- horizontal line to cx.%d", format_low )); - if ( format_low > x_count ) + if ( format_low > x_count || x_count == 0 ) goto Failure; pos[0].x = glyph->x_control[format_low]; pos[0].y = pos[3].y; @@ -398,7 +398,7 @@ case 3: /* vertical line to */ FT_TRACE6(( "- vertical line to cy.%d", format_low )); - if ( format_low > y_count ) + if ( format_low > y_count || y_count == 0 ) goto Failure; pos[0].x = pos[3].x; pos[0].y = glyph->y_control[format_low]; @@ -440,7 +440,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > x_count ) + if ( idx > x_count || x_count == 0 ) goto Failure; cur->x = glyph->x_control[idx]; FT_TRACE7(( " cx#%d", idx )); @@ -470,7 +470,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > y_count ) + if ( idx > y_count || y_count == 0 ) goto Failure; cur->y = glyph->y_control[idx]; FT_TRACE7(( " cy#%d", idx ));