aboutsummaryrefslogtreecommitdiff
path: root/freetype/src/type1
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2011-01-16 17:43:39 +0000
committermarha <marha@users.sourceforge.net>2011-01-16 17:43:39 +0000
commit2177eb8fad173f2b0fe04f188c4d6dadaa8f4441 (patch)
tree862ef4b348586f932593a7d2b599913230059cdd /freetype/src/type1
parent367c91bebcdc1f5ba4278b68eb8715218d9640ad (diff)
downloadvcxsrv-2177eb8fad173f2b0fe04f188c4d6dadaa8f4441.tar.gz
vcxsrv-2177eb8fad173f2b0fe04f188c4d6dadaa8f4441.tar.bz2
vcxsrv-2177eb8fad173f2b0fe04f188c4d6dadaa8f4441.zip
freetype 2.4.4
Diffstat (limited to 'freetype/src/type1')
-rw-r--r--freetype/src/type1/t1load.c18
1 files changed, 12 insertions, 6 deletions
diff --git a/freetype/src/type1/t1load.c b/freetype/src/type1/t1load.c
index d867e942c..c9b6c1d0a 100644
--- a/freetype/src/type1/t1load.c
+++ b/freetype/src/type1/t1load.c
@@ -4,7 +4,8 @@
/* */
/* Type 1 font loader (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, */
+/* 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -1045,7 +1046,8 @@
if ( cur < limit && ft_isdigit( *cur ) )
{
- *size = T1_ToInt( parser );
+ FT_Long s = T1_ToInt( parser );
+
T1_Skip_PS_Token( parser ); /* `RD' or `-|' or something else */
@@ -1053,8 +1055,12 @@
/* `RD' or `-|' token */
*base = parser->root.cursor + 1;
- parser->root.cursor += *size + 1;
- return !parser->root.error;
+ if ( s >= 0 && s < limit - *base )
+ {
+ parser->root.cursor += s + 1;
+ *size = s;
+ return !parser->root.error;
+ }
}
FT_ERROR(( "read_binary_data: invalid size field\n" ));
@@ -1111,7 +1117,7 @@
temp[2] = FT_DivFix( temp[2], temp_scale );
temp[4] = FT_DivFix( temp[4], temp_scale );
temp[5] = FT_DivFix( temp[5], temp_scale );
- temp[3] = 0x10000L;
+ temp[3] = temp[3] < 0 ? -0x10000L : 0x10000L;
}
matrix->xx = temp[0];
@@ -2180,7 +2186,7 @@
/* OK, we do the following: for each element in the encoding */
/* table, look up the index of the glyph having the same name */
/* the index is then stored in type1.encoding.char_index, and */
- /* a the name to type1.encoding.char_name */
+ /* the name to type1.encoding.char_name */
min_char = 0;
max_char = 0;