diff options
| author | marha <marha@users.sourceforge.net> | 2011-01-16 19:26:40 +0000 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2011-01-16 19:26:40 +0000 |
| commit | 4e370208d0f941a4cceb6f9fefa78444c2bf3498 (patch) | |
| tree | 543c693b5dee03c965b0c9ef79869a8536024432 /freetype/src/type1 | |
| parent | 1eaf4b3f1d746b054298358d81233364bb1b7ba2 (diff) | |
| parent | 2177eb8fad173f2b0fe04f188c4d6dadaa8f4441 (diff) | |
| download | vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.tar.gz vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.tar.bz2 vcxsrv-4e370208d0f941a4cceb6f9fefa78444c2bf3498.zip | |
svn merge ^/branches/released .
Diffstat (limited to 'freetype/src/type1')
| -rw-r--r-- | freetype/src/type1/t1load.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/freetype/src/type1/t1load.c b/freetype/src/type1/t1load.c index a558288ab..480a3a6b0 100644 --- a/freetype/src/type1/t1load.c +++ b/freetype/src/type1/t1load.c @@ -4,7 +4,8 @@ /* */ /* Type 1 font loader (body). */ /* */ -/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */ +/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, */ +/* 2010 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -1045,7 +1046,8 @@ if ( cur < limit && ft_isdigit( *cur ) ) { - *size = T1_ToInt( parser ); + FT_Long s = T1_ToInt( parser ); + T1_Skip_PS_Token( parser ); /* `RD' or `-|' or something else */ @@ -1053,8 +1055,12 @@ /* `RD' or `-|' token */ *base = parser->root.cursor + 1; - parser->root.cursor += *size + 1; - return !parser->root.error; + if ( s >= 0 && s < limit - *base ) + { + parser->root.cursor += s + 1; + *size = s; + return !parser->root.error; + } } FT_ERROR(( "read_binary_data: invalid size field\n" )); @@ -1111,7 +1117,7 @@ temp[2] = FT_DivFix( temp[2], temp_scale ); temp[4] = FT_DivFix( temp[4], temp_scale ); temp[5] = FT_DivFix( temp[5], temp_scale ); - temp[3] = 0x10000L; + temp[3] = temp[3] < 0 ? -0x10000L : 0x10000L; } matrix->xx = temp[0]; @@ -2180,7 +2186,7 @@ /* OK, we do the following: for each element in the encoding */ /* table, look up the index of the glyph having the same name */ /* the index is then stored in type1.encoding.char_index, and */ - /* a the name to type1.encoding.char_name */ + /* the name to type1.encoding.char_name */ min_char = 0; max_char = 0; |