diff options
| author | Werner Lemberg <wl@gnu.org> | 2010-10-06 11:52:27 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2010-10-06 11:52:27 +0200 |
| commit | 0edf0986f3be570f5bf90ff245a85c1675f5c9a4 (patch) | |
| tree | daf9338e0eb72411082976a19bc01bdad0089656 | |
| parent | 94d540ef7753749700eda06cff6be954cdd5ab6e (diff) | |
| download | freetype2-0edf0986f3be570f5bf90ff245a85c1675f5c9a4.tar.gz | |
[truetype] Improve error handling of `SHZ' bytecode instruction.
Problem reported by Chris Evans <scarybeasts@gmail.com>.
* src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/truetype/ttinterp.c | 9 |
2 files changed, 16 insertions, 0 deletions
@@ -1,3 +1,10 @@ +2010-10-06 Werner Lemberg <wl@gnu.org> + + [truetype] Improve error handling of `SHZ' bytecode instruction. + Problem reported by Chris Evans <scarybeasts@gmail.com>. + + * src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'. + 2010-10-05 Werner Lemberg <wl@gnu.org> Fix Savannah bug #31253. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index bf9189c..e196dce 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -5795,7 +5795,16 @@ if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 ) last_point = (FT_UShort)( CUR.zp2.n_points - 1 ); else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 ) + { last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] ); + + if ( BOUNDS( last_point, CUR.zp2.n_points ) ) + { + if ( CUR.pedantic_hinting ) + CUR.error = TT_Err_Invalid_Reference; + return; + } + } else last_point = 0; |
