rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412
This commit is contained in:
Werner Lemberg 2018-07-16 05:45:45 +02:00
parent 9f15370e56
commit 839cb404cf
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,3 +1,11 @@
2018-07-16 Werner Lemberg <wl@gnu.org>
* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412
2018-07-12 Werner Lemberg <wl@gnu.org>
* src/base/ftoutln.c (FT_Outline_Get_Orientation): Init `cbox'.

7
src/truetype/ttgxvar.c
View File

@ -2533,11 +2533,14 @@
if ( FT_IS_NAMED_INSTANCE( FT_FACE( face ) ) )
{
FT_UInt idx = (FT_UInt)face->root.face_index >> 16;
FT_UInt instance_index = (FT_UInt)face->root.face_index >> 16;
c = blend->normalizedcoords + i;
n = blend->normalized_stylecoords + idx * mmvar->num_axis + i;
n = blend->normalized_stylecoords +
( instance_index - 1 ) * mmvar->num_axis +
i;
for ( j = i; j < mmvar->num_axis; j++, n++, c++ )
if ( *c != *n )
have_diff = 1;