diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-24 09:31:32 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-24 09:31:32 +0100 |
| commit | f70d9342e65cd2cb44e9f26b6d7edeedf191fc6c (patch) | |
| tree | 3d720a46dadc38e253d61d4daaa50f64f2463ac4 | |
| parent | 73be9f9ab67842cfbec36ee99e8d2301434c84ca (diff) | |
| download | freetype2-f70d9342e65cd2cb44e9f26b6d7edeedf191fc6c.tar.gz | |
[sfnt] Fix Savannah bug #43672.
* src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for
minimum table length test.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/sfnt/ttkern.c | 2 |
2 files changed, 8 insertions, 1 deletions
@@ -1,5 +1,12 @@ 2014-11-24 Werner Lemberg <wl@gnu.org> + [sfnt] Fix Savannah bug #43672. + + * src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for + minimum table length test. + +2014-11-24 Werner Lemberg <wl@gnu.org> + [type1, type42] Another fix for Savannah bug #43655. * src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c index 32c4008..455e7b5 100644 --- a/src/sfnt/ttkern.c +++ b/src/sfnt/ttkern.c @@ -99,7 +99,7 @@ length = FT_NEXT_USHORT( p ); coverage = FT_NEXT_USHORT( p ); - if ( length <= 6 ) + if ( length <= 6 + 8 ) break; p_next += length; |
