From c220d8b498a66e241872ea4b39a8902177e5fac3 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 10 Oct 2015 08:13:04 +0200
Subject: [PATCH] [truetype] Better protection against malformed GX data
 (#46166).

* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Correctly
handle empty `localpoints' array.
---
 ChangeLog              | 7 +++++++
 src/truetype/ttgxvar.c | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 4cc2e536f..20e8b47d7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-10-10  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Better protection against malformed GX data (#46166).
+
+	* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Correctly
+	handle empty `localpoints' array.
+
 2015-10-10  Werner Lemberg  <wl@gnu.org>
 
 	* src/pcf/pcfread.c (pcf_read_TOC): Check stream size (#46162).
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index dd9e250c9..e838b8765 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1950,6 +1950,9 @@
 #endif
       }
 
+      else if ( localpoints == NULL )
+        ; /* failure, ignore it */
+
       else
       {
 #ifdef FT_DEBUG_LEVEL_TRACE