From 47ed6413ce8f2586b8d542dc46055e075a47022e Mon Sep 17 00:00:00 2001 From: marha Date: Fri, 6 Aug 2010 10:14:25 +0000 Subject: Updated to freetype 2.4.1 --- freetype/src/truetype/ttgxvar.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'freetype/src/truetype/ttgxvar.c') diff --git a/freetype/src/truetype/ttgxvar.c b/freetype/src/truetype/ttgxvar.c index ef25aafb5..653d9d5cf 100644 --- a/freetype/src/truetype/ttgxvar.c +++ b/freetype/src/truetype/ttgxvar.c @@ -4,7 +4,7 @@ /* */ /* TrueType GX Font Variation loader */ /* */ -/* Copyright 2004, 2005, 2006, 2007, 2008, 2009 by */ +/* Copyright 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */ /* David Turner, Robert Wilhelm, Werner Lemberg, and George Williams. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -210,12 +210,12 @@ ft_var_readpackeddeltas( FT_Stream stream, FT_Offset delta_cnt ) { - FT_Short *deltas; + FT_Short *deltas = NULL; FT_UInt runcnt; FT_Offset i; FT_UInt j; FT_Memory memory = stream->memory; - FT_Error error = TT_Err_Ok; + FT_Error error = TT_Err_Ok; FT_UNUSED( error ); @@ -682,7 +682,11 @@ if ( fvar_head.version != (FT_Long)0x00010000L || fvar_head.countSizePairs != 2 || fvar_head.axisSize != 20 || + /* axisCount limit implied by 16-bit instanceSize */ + fvar_head.axisCount > 0x3FFE || fvar_head.instanceSize != 4 + 4 * fvar_head.axisCount || + /* instanceCount limit implied by limited range of name IDs */ + fvar_head.instanceCount > 0x7EFF || fvar_head.offsetToData + fvar_head.axisCount * 20U + fvar_head.instanceCount * fvar_head.instanceSize > table_len ) { @@ -693,7 +697,7 @@ if ( FT_NEW( face->blend ) ) goto Exit; - /* XXX: TODO - check for overflows */ + /* cannot overflow 32-bit arithmetic because of limits above */ face->blend->mmvar_len = sizeof ( FT_MM_Var ) + fvar_head.axisCount * sizeof ( FT_Var_Axis ) + -- cgit v1.2.3