diff options
author | marha <marha@users.sourceforge.net> | 2011-01-16 19:26:40 +0000 |
---|---|---|
committer | marha <marha@users.sourceforge.net> | 2011-01-16 19:26:40 +0000 |
commit | 4e370208d0f941a4cceb6f9fefa78444c2bf3498 (patch) | |
tree | 543c693b5dee03c965b0c9ef79869a8536024432 /freetype/src/truetype/ttpload.c | |
parent | 1eaf4b3f1d746b054298358d81233364bb1b7ba2 (diff) | |
parent | 2177eb8fad173f2b0fe04f188c4d6dadaa8f4441 (diff) | |
download | vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.tar.gz vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.tar.bz2 vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.zip |
svn merge ^/branches/released .
Diffstat (limited to 'freetype/src/truetype/ttpload.c')
-rw-r--r-- | freetype/src/truetype/ttpload.c | 30 |
1 files changed, 28 insertions, 2 deletions
diff --git a/freetype/src/truetype/ttpload.c b/freetype/src/truetype/ttpload.c index 39daa38c2..56d6efe58 100644 --- a/freetype/src/truetype/ttpload.c +++ b/freetype/src/truetype/ttpload.c @@ -4,7 +4,7 @@ /* */ /* TrueType-specific tables loader (body). */ /* */ -/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by */ +/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -137,6 +137,12 @@ dist = diff; } + if ( entry == limit ) + { + /* `loca' is the last table */ + dist = stream->size - pos; + } + if ( new_loca_len <= dist ) { face->num_locations = face->root.num_glyphs; @@ -203,6 +209,26 @@ } } + /* Check broken location data */ + if ( pos1 >= face->glyf_len ) + { + FT_TRACE1(( "tt_face_get_location:" + " too large offset=0x%08lx found for gid=0x%04lx," + " exceeding the end of glyf table (0x%08lx)\n", + pos1, gindex, face->glyf_len )); + *asize = 0; + return 0; + } + + if ( pos2 >= face->glyf_len ) + { + FT_TRACE1(( "tt_face_get_location:" + " too large offset=0x%08lx found for gid=0x%04lx," + " truncate at the end of glyf table (0x%08lx)\n", + pos2, gindex + 1, face->glyf_len )); + pos2 = face->glyf_len; + } + /* The `loca' table must be ordered; it refers to the length of */ /* an entry as the difference between the current and the next */ /* position. However, there do exist (malformed) fonts which */ @@ -287,7 +313,7 @@ FT_Short* limit = cur + face->cvt_size; - for ( ; cur < limit; cur++ ) + for ( ; cur < limit; cur++ ) *cur = FT_GET_SHORT(); } |