diff options
Diffstat (limited to 'freetype/src/gxvalid/gxvmorx2.c')
| -rw-r--r-- | freetype/src/gxvalid/gxvmorx2.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/freetype/src/gxvalid/gxvmorx2.c b/freetype/src/gxvalid/gxvmorx2.c index bc18c6b8a..9d2b0bc4a 100644 --- a/freetype/src/gxvalid/gxvmorx2.c +++ b/freetype/src/gxvalid/gxvmorx2.c @@ -173,6 +173,7 @@ FT_UShort store; #endif FT_ULong offset; + FT_Long gid_limit; lig_action = FT_NEXT_ULONG( p ); @@ -186,8 +187,9 @@ /* this offset is 30-bit signed value to add to GID */ /* it is different from the location offset in mort */ if ( ( offset & 0x3FFF0000UL ) == 0x3FFF0000UL ) - { - if ( offset + valid->face->num_glyphs > 0x40000000UL ) + { /* negative offset */ + gid_limit = valid->face->num_glyphs - ( offset & 0x0000FFFFUL ); + if ( gid_limit > 0 ) return; GXV_TRACE(( "ligature action table includes" @@ -197,8 +199,8 @@ GXV_SET_ERR_IF_PARANOID( FT_INVALID_OFFSET ); } else if ( ( offset & 0x3FFF0000UL ) == 0x0000000UL ) - { - if ( offset + valid->face->num_glyphs < 0 ) + { /* positive offset */ + if ( (FT_Long)offset < valid->face->num_glyphs ) return; GXV_TRACE(( "ligature action table includes" |