diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-22 06:24:45 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-22 06:24:45 +0100 |
| commit | 9bd20b7304aae61de5d50ac359cf27132bafd4c1 (patch) | |
| tree | 26c31df67f6daf6b7a7419212bdbfc71618437c2 | |
| parent | dd89710f0f643eb0f99a3830e0712d26c7642acd (diff) | |
| download | freetype2-9bd20b7304aae61de5d50ac359cf27132bafd4c1.tar.gz | |
[sfnt] Fix Savannah bug #43656.
* src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity
tests.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/sfnt/ttcmap.c | 6 |
2 files changed, 10 insertions, 3 deletions
@@ -1,3 +1,10 @@ +2014-11-22 Werner Lemberg <wl@gnu.org> + + [sfnt] Fix Savannah bug #43656. + + * src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity + tests. + 2014-11-21 Werner Lemberg <wl@gnu.org> [type1, type42] Fix Savannah bug #43655. diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c index 712bd4f..fb863c3 100644 --- a/src/sfnt/ttcmap.c +++ b/src/sfnt/ttcmap.c @@ -845,9 +845,6 @@ p = table + 2; /* skip format */ length = TT_NEXT_USHORT( p ); - if ( length < 16 ) - FT_INVALID_TOO_SHORT; - /* in certain fonts, the `length' field is invalid and goes */ /* out of bound. We try to correct this here... */ if ( table + length > valid->limit ) @@ -858,6 +855,9 @@ length = (FT_UInt)( valid->limit - table ); } + if ( length < 16 ) + FT_INVALID_TOO_SHORT; + p = table + 6; num_segs = TT_NEXT_USHORT( p ); /* read segCountX2 */ |
