summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-22 06:24:45 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-22 06:24:45 +0100
commit9bd20b7304aae61de5d50ac359cf27132bafd4c1 (patch)
tree26c31df67f6daf6b7a7419212bdbfc71618437c2
parentdd89710f0f643eb0f99a3830e0712d26c7642acd (diff)
downloadfreetype2-9bd20b7304aae61de5d50ac359cf27132bafd4c1.tar.gz
[sfnt] Fix Savannah bug #43656.
* src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity tests.
-rw-r--r--ChangeLog7
-rw-r--r--src/sfnt/ttcmap.c6
2 files changed, 10 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index ee27f70..150f65a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-11-22 Werner Lemberg <wl@gnu.org>
+
+ [sfnt] Fix Savannah bug #43656.
+
+ * src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity
+ tests.
+
2014-11-21 Werner Lemberg <wl@gnu.org>
[type1, type42] Fix Savannah bug #43655.
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index 712bd4f..fb863c3 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -845,9 +845,6 @@
p = table + 2; /* skip format */
length = TT_NEXT_USHORT( p );
- if ( length < 16 )
- FT_INVALID_TOO_SHORT;
-
/* in certain fonts, the `length' field is invalid and goes */
/* out of bound. We try to correct this here... */
if ( table + length > valid->limit )
@@ -858,6 +855,9 @@
length = (FT_UInt)( valid->limit - table );
}
+ if ( length < 16 )
+ FT_INVALID_TOO_SHORT;
+
p = table + 6;
num_segs = TT_NEXT_USHORT( p ); /* read segCountX2 */