forked from minhngoc25a/freetype2
[truetype] Fix VF check from 2018-09-12 (#54973).
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Use correct offsets for estimates.
This commit is contained in:
parent
fbd2452346
commit
fb0d66d04c
|
@ -1,3 +1,10 @@
|
||||||
|
2018-11-07 Ben Wagner <bungeman@google.com>
|
||||||
|
|
||||||
|
[truetype] Fix VF check from 2018-09-12 (#54973).
|
||||||
|
|
||||||
|
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Use correct
|
||||||
|
offsets for estimates.
|
||||||
|
|
||||||
2018-11-06 Werner Lemberg <wl@gnu.org>
|
2018-11-06 Werner Lemberg <wl@gnu.org>
|
||||||
|
|
||||||
[pshinter] Fix numeric overflow.
|
[pshinter] Fix numeric overflow.
|
||||||
|
|
|
@ -3725,8 +3725,8 @@
|
||||||
offsetToData = FT_GET_USHORT();
|
offsetToData = FT_GET_USHORT();
|
||||||
|
|
||||||
/* rough sanity test */
|
/* rough sanity test */
|
||||||
if ( offsetToData + ( tupleCount & GX_TC_TUPLE_COUNT_MASK ) * 4 >
|
if ( offsetToData > dataSize ||
|
||||||
dataSize )
|
( tupleCount & GX_TC_TUPLE_COUNT_MASK ) * 4 > dataSize )
|
||||||
{
|
{
|
||||||
FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
|
FT_TRACE2(( "TT_Vary_Apply_Glyph_Deltas:"
|
||||||
" invalid glyph variation array header\n" ));
|
" invalid glyph variation array header\n" ));
|
||||||
|
|
Loading…
Reference in New Issue