rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[winfnt] Fix Savannah bug #41694. 

* src/winfonts/winfnt.c (FNT_Load_Glyph): Check glyph offset.
This commit is contained in:
Werner Lemberg 2014-02-26 18:12:36 +01:00
parent 08c628d128
commit eee4ff8d5a
2 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,10 +1,16 @@
2014-02-26 Wermer Lemberg <wl@gnu.org>
2014-02-26 Werner Lemberg <wl@gnu.org>
[winfnt] Fix Savannah bug #41694.
* src/winfonts/winfnt.c (FNT_Load_Glyph): Check glyph offset.
2014-02-26 Werner Lemberg <wl@gnu.org>
[cff] Fix Savannah bug #41693.
* src/cff/cffload.c (CFF_Load_FD_Select): Reject empty array.
2014-02-26 Wermer Lemberg <wl@gnu.org>
2014-02-26 Werner Lemberg <wl@gnu.org>
[bdf] Fix Savannah bug #41692.

20
src/winfonts/winfnt.c
View File

@ -4,7 +4,7 @@
/* */
/* FreeType font driver for Windows FNT/FON files */
/* */
/* Copyright 1996-2004, 2006-2013 by */
/* Copyright 1996-2004, 2006-2014 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* Copyright 2003 Huw D M Davies for Codeweavers */
/* Copyright 2007 Dmitry Timoshkov for Codeweavers */
@ -977,7 +977,7 @@
font = face->font;
if ( !font ||
if ( !font ||
glyph_index >= (FT_UInt)( FT_FACE( face )->num_glyphs ) )
{
error = FT_THROW( Invalid_Argument );
@ -989,16 +989,26 @@
if ( glyph_index > 0 )
glyph_index--; /* revert to real index */
else
glyph_index = font->header.default_char; /* the .notdef glyph */
glyph_index = font->header.default_char; /* the `.notdef' glyph */
new_format = FT_BOOL( font->header.version == 0x300 );
len = new_format ? 6 : 4;
/* jump to glyph entry */
p = font->fnt_frame + ( new_format ? 148 : 118 ) + len * glyph_index;
/* get glyph width and offset */
offset = ( new_format ? 148 : 118 ) + len * glyph_index;
if ( offset >= font->header.file_size - 2 - ( new_format ? 4 : 2 ) )
{
FT_TRACE2(( "invalid FNT offset\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
p = font->fnt_frame + offset;
bitmap->width = FT_NEXT_SHORT_LE( p );
/* jump to glyph entry */
if ( new_format )
offset = FT_NEXT_ULONG_LE( p );
else