rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

* src/truetype/ttpload.c (tt_face_load_hdmx): Ignore `version'. 

Problem reported by 張俊芝 <418092625@qq.com>.
This commit is contained in:
Werner Lemberg 2016-12-24 09:27:15 +01:00
parent d1db57c284
commit a300c1c3af
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2016-12-24 Werner Lemberg <wl@gnu.org>
* src/truetype/ttpload.c (tt_face_load_hdmx): Ignore `version'.
Problem reported by 張俊芝 <418092625@qq.com>.
2016-12-24 Werner Lemberg <wl@gnu.org>
* src/sfnt/ttsbit.c (tt_face_load_sbit): Allow more version values.

10
src/truetype/ttpload.c
View File

@ -524,7 +524,7 @@
{
FT_Error error;
FT_Memory memory = stream->memory;
FT_UInt version, nn, num_records;
FT_UInt nn, num_records;
FT_ULong table_size, record_size;
FT_Byte* p;
FT_Byte* limit;
@ -541,7 +541,10 @@
p = face->hdmx_table;
limit = p + table_size;
version = FT_NEXT_USHORT( p );
/* Given that `hdmx' tables are losing its importance (for example, */
/* variation fonts introduced in OpenType 1.8 must not have this */
/* table) we no longer test for a correct `version' field. */
p += 2;
num_records = FT_NEXT_USHORT( p );
record_size = FT_NEXT_ULONG( p );
@ -560,8 +563,7 @@
record_size &= 0xFFFFU;
/* The limit for `num_records' is a heuristic value. */
if ( version != 0 ||
num_records > 255 ||
if ( num_records > 255 ||
( num_records > 0 &&
( record_size > 0x10001L ||
record_size < 4 ) ) )