summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-21 22:19:28 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-21 22:19:28 +0100
commitdd89710f0f643eb0f99a3830e0712d26c7642acd (patch)
treeb9b3dc7badbf25983a4ce8a496ac945709114ec7
parentb1fc00d5dc0e89432c58367477b6d9d63b6b0be9 (diff)
downloadfreetype2-dd89710f0f643eb0f99a3830e0712d26c7642acd.tar.gz
[type1, type42] Fix Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c (t42_parse_charstrings): Fix boundary testing.
-rw-r--r--ChangeLog7
-rw-r--r--src/type1/t1load.c2
-rw-r--r--src/type42/t42parse.c2
3 files changed, 9 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 630771b..ee27f70 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-21 Werner Lemberg <wl@gnu.org>
+ [type1, type42] Fix Savannah bug #43655.
+
+ * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
+ (t42_parse_charstrings): Fix boundary testing.
+
+2014-11-21 Werner Lemberg <wl@gnu.org>
+
* src/pcf/pcfread.c (pcf_get_metrics): Sanitize invalid metrics.
2014-11-21 Werner Lemberg <wl@gnu.org>
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index fd06432..caa75bd 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1604,7 +1604,7 @@
FT_PtrDist len;
- if ( cur + 1 >= limit )
+ if ( cur + 2 >= limit )
{
error = FT_THROW( Invalid_File_Format );
goto Fail;
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index 9b66888..a60e216 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -858,7 +858,7 @@
FT_PtrDist len;
- if ( cur + 1 >= limit )
+ if ( cur + 2 >= limit )
{
FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
error = FT_THROW( Invalid_File_Format );