forked from minhngoc25a/freetype2
[truetype] Fix Savannah bug #35640.
* src/truetype/ttinterp.c (SkipCode, TT_RunIns): Fix boundary check for NPUSHB and NPUSHW instructions.
This commit is contained in:
parent
96cddb8d1d
commit
5dddcc45a0
|
@ -1,3 +1,10 @@
|
||||||
|
2012-02-29 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
|
[truetype] Fix Savannah bug #35640.
|
||||||
|
|
||||||
|
* src/truetype/ttinterp.c (SkipCode, TT_RunIns): Fix boundary check
|
||||||
|
for NPUSHB and NPUSHW instructions.
|
||||||
|
|
||||||
2012-02-29 Werner Lemberg <wl@gnu.org>
|
2012-02-29 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
[truetype] Fix Savannah bug #35601.
|
[truetype] Fix Savannah bug #35601.
|
||||||
|
|
|
@ -4477,7 +4477,7 @@
|
||||||
CUR.length = opcode_length[CUR.opcode];
|
CUR.length = opcode_length[CUR.opcode];
|
||||||
if ( CUR.length < 0 )
|
if ( CUR.length < 0 )
|
||||||
{
|
{
|
||||||
if ( CUR.IP + 1 > CUR.codeSize )
|
if ( CUR.IP + 1 >= CUR.codeSize )
|
||||||
goto Fail_Overflow;
|
goto Fail_Overflow;
|
||||||
CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
|
CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
|
||||||
}
|
}
|
||||||
|
@ -7544,7 +7544,7 @@
|
||||||
|
|
||||||
if ( ( CUR.length = opcode_length[CUR.opcode] ) < 0 )
|
if ( ( CUR.length = opcode_length[CUR.opcode] ) < 0 )
|
||||||
{
|
{
|
||||||
if ( CUR.IP + 1 > CUR.codeSize )
|
if ( CUR.IP + 1 >= CUR.codeSize )
|
||||||
goto LErrorCodeOverflow_;
|
goto LErrorCodeOverflow_;
|
||||||
|
|
||||||
CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
|
CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
|
||||||
|
|
Loading…
Reference in New Issue