diff options
| author | Mike DePaulo <mikedep333@gmail.com> | 2015-02-28 07:31:25 -0500 |
|---|---|---|
| committer | Mike DePaulo <mikedep333@gmail.com> | 2015-02-28 18:11:34 -0500 |
| commit | 360fe27b55c93c9c6c86895dbbf5db3efc66cc43 (patch) | |
| tree | 01d8b3510d6a36ceba211168268d09658a8aa68b /freetype/src/truetype/ttpload.c | |
| parent | a769ab7159f0718e189f1aaa8b6a5a046c66c52c (diff) | |
| download | vcxsrv-360fe27b55c93c9c6c86895dbbf5db3efc66cc43.tar.gz vcxsrv-360fe27b55c93c9c6c86895dbbf5db3efc66cc43.tar.bz2 vcxsrv-360fe27b55c93c9c6c86895dbbf5db3efc66cc43.zip | |
Updated to freetype 2.5.5
Conflicts:
freetype/src/base/ftbdf.c
freetype/src/base/fttype1.c
freetype/src/pfr/pfrobjs.c
Diffstat (limited to 'freetype/src/truetype/ttpload.c')
| -rw-r--r-- | freetype/src/truetype/ttpload.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/freetype/src/truetype/ttpload.c b/freetype/src/truetype/ttpload.c index 2ee5d38b8..33bca68fe 100644 --- a/freetype/src/truetype/ttpload.c +++ b/freetype/src/truetype/ttpload.c @@ -508,9 +508,9 @@ record_size = FT_NEXT_ULONG( p ); /* The maximum number of bytes in an hdmx device record is the */ - /* maximum number of glyphs + 2; this is 0xFFFF + 2; this is */ - /* the reason why `record_size' is a long (which we read as */ - /* unsigned long for convenience). In practice, two bytes */ + /* maximum number of glyphs + 2; this is 0xFFFF + 2, thus */ + /* explaining why `record_size' is a long (which we read as */ + /* unsigned long for convenience). In practice, two bytes are */ /* sufficient to hold the size value. */ /* */ /* There are at least two fonts, HANNOM-A and HANNOM-B version */ @@ -522,8 +522,10 @@ record_size &= 0xFFFFU; /* The limit for `num_records' is a heuristic value. */ - - if ( version != 0 || num_records > 255 || record_size > 0x10001L ) + if ( version != 0 || + num_records > 255 || + record_size > 0x10001L || + record_size < 4 ) { error = FT_THROW( Invalid_File_Format ); goto Fail; |