forked from minhngoc25a/freetype2
![]() When iterating over the cvt tuples and reading in the points it is necessary to set all of `localpoints`, `points`, and `point_count` in all cases. The existing code did not reset `localpoints` to `NULL` when there were no private point numbers. If the previous tuple did have private point numbers and set `localpoints` to `ALL_POINTS` this would not be cleared and the wrong branch would be taken later, leading to possible heap buffer overflow. * src/truetype/ttgxvar.c (tt_face_vary_cvt): Reset `localpoints` to `NULL` when it isn't valid. Fixes: https://crbug.com/1284742 |
||
---|---|---|
.. | ||
module.mk | ||
rules.mk | ||
truetype.c | ||
ttdriver.c | ||
ttdriver.h | ||
tterrors.h | ||
ttgload.c | ||
ttgload.h | ||
ttgxvar.c | ||
ttgxvar.h | ||
ttinterp.c | ||
ttinterp.h | ||
ttobjs.c | ||
ttobjs.h | ||
ttpload.c | ||
ttpload.h | ||
ttsubpix.c | ||
ttsubpix.h |