diff options
| author | Dave Arnold <darnold@adobe.com> | 2014-02-28 07:40:01 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-02-28 07:45:07 +0100 |
| commit | 0eae6eb0645264c98812f0095e0f5df4541830e6 (patch) | |
| tree | e06d8401ee7f26207e8ee12a85b0fd2cf92fae60 | |
| parent | a2b5f66bf5eaf393eb800ac402c74f69534b74ba (diff) | |
| download | freetype2-0eae6eb0645264c98812f0095e0f5df4541830e6.tar.gz | |
Fix Savannah bug #41697, part 1.
* src/cff/cf2hints.c (cf2_hintmap_build): Return when `hintMask' is
invalid. In this case, it is not safe to use the length of
`hStemHintArray'; the exception has already been recorded in
`hintMask'.
| -rw-r--r-- | ChangeLog | 9 | ||||
| -rw-r--r-- | src/cff/cf2hints.c | 2 |
2 files changed, 11 insertions, 0 deletions
@@ -1,3 +1,12 @@ +2014-02-28 Dave Arnold <darnold@adobe.com> + + [cff] Fix Savannah bug #41697, part 1. + + * src/cff/cf2hints.c (cf2_hintmap_build): Return when `hintMask' is + invalid. In this case, it is not safe to use the length of + `hStemHintArray'; the exception has already been recorded in + `hintMask'. + 2014-02-26 Werner Lemberg <wl@gnu.org> [sfnt] Fix Savannah bug #41696. diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c index 5f44161..79f84fc 100644 --- a/src/cff/cf2hints.c +++ b/src/cff/cf2hints.c @@ -781,6 +781,8 @@ cf2_hintmask_setAll( hintMask, cf2_arrstack_size( hStemHintArray ) + cf2_arrstack_size( vStemHintArray ) ); + if ( !cf2_hintmask_isValid( hintMask ) ) + return; /* too many stem hints */ } /* begin by clearing the map */ |
