rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Better protection against malformed `fpgm' (#46223). 

* src/truetype/ttobjs.c (tt_size_init_bytecode): Don't execute a
malformed `fpgm' table more than once.
This commit is contained in:
Werner Lemberg 2015-10-18 16:47:06 +02:00
parent 7643b5839b
commit dcfc4d9c21
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2015-10-18 Werner Lemberg <wl@gnu.org>
[truetype] Better protection against malformed `fpgm' (#46223).
* src/truetype/ttobjs.c (tt_size_init_bytecode): Don't execute a
malformed `fpgm' table more than once.
2015-10-17 Werner Lemberg <wl@gnu.org>
* src/cid/cidgload.c (cid_load_glyph): Fix memory leak.

8
src/truetype/ttobjs.c
View File

@ -1078,7 +1078,15 @@
}
/* Fine, now run the font program! */
/* In case of an error while executing `fpgm', we intentionally don't */
/* clean up immediately – bugs in the `fpgm' are so fundamental that */
/* all following hinting calls should fail. Additionally, `fpgm' is */
/* to be executed just once; calling it again is completely useless */
/* and might even lead to extremely slow behaviour if it is malformed */
/* (containing an infinite loop, for example). */
error = tt_size_run_fpgm( size, pedantic );
return error;
Exit:
if ( error )