summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-24 09:31:32 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-24 09:31:32 +0100
commitf70d9342e65cd2cb44e9f26b6d7edeedf191fc6c (patch)
tree3d720a46dadc38e253d61d4daaa50f64f2463ac4
parent73be9f9ab67842cfbec36ee99e8d2301434c84ca (diff)
downloadfreetype2-f70d9342e65cd2cb44e9f26b6d7edeedf191fc6c.tar.gz
[sfnt] Fix Savannah bug #43672.
* src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for minimum table length test.
-rw-r--r--ChangeLog7
-rw-r--r--src/sfnt/ttkern.c2
2 files changed, 8 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index c19dbe8..432186e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2014-11-24 Werner Lemberg <wl@gnu.org>
+ [sfnt] Fix Savannah bug #43672.
+
+ * src/sfnt/ttkern.c (tt_face_load_kern): Use correct value for
+ minimum table length test.
+
+2014-11-24 Werner Lemberg <wl@gnu.org>
+
[type1, type42] Another fix for Savannah bug #43655.
* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index 32c4008..455e7b5 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -99,7 +99,7 @@
length = FT_NEXT_USHORT( p );
coverage = FT_NEXT_USHORT( p );
- if ( length <= 6 )
+ if ( length <= 6 + 8 )
break;
p_next += length;