summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDave Arnold <darnold@adobe.com>2014-02-28 07:40:01 +0100
committerWerner Lemberg <wl@gnu.org>2014-02-28 07:45:07 +0100
commit0eae6eb0645264c98812f0095e0f5df4541830e6 (patch)
treee06d8401ee7f26207e8ee12a85b0fd2cf92fae60
parenta2b5f66bf5eaf393eb800ac402c74f69534b74ba (diff)
downloadfreetype2-0eae6eb0645264c98812f0095e0f5df4541830e6.tar.gz
Fix Savannah bug #41697, part 1.
* src/cff/cf2hints.c (cf2_hintmap_build): Return when `hintMask' is invalid. In this case, it is not safe to use the length of `hStemHintArray'; the exception has already been recorded in `hintMask'.
-rw-r--r--ChangeLog9
-rw-r--r--src/cff/cf2hints.c2
2 files changed, 11 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 2010fda..1f48e24 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2014-02-28 Dave Arnold <darnold@adobe.com>
+
+ [cff] Fix Savannah bug #41697, part 1.
+
+ * src/cff/cf2hints.c (cf2_hintmap_build): Return when `hintMask' is
+ invalid. In this case, it is not safe to use the length of
+ `hStemHintArray'; the exception has already been recorded in
+ `hintMask'.
+
2014-02-26 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #41696.
diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c
index 5f44161..79f84fc 100644
--- a/src/cff/cf2hints.c
+++ b/src/cff/cf2hints.c
@@ -781,6 +781,8 @@
cf2_hintmask_setAll( hintMask,
cf2_arrstack_size( hStemHintArray ) +
cf2_arrstack_size( vStemHintArray ) );
+ if ( !cf2_hintmask_isValid( hintMask ) )
+ return; /* too many stem hints */
}
/* begin by clearing the map */