ref: 18b552f6aeb84dc6fb5f9b8a3b37e0d4414de45e
parent: 8bebaa74cc3628ec5729823645dc41ef3d93873b
author: Werner Lemberg <[email protected]>
date: Sun Jun 27 11:41:02 EDT 2010
[cff] Really fix `hintmask' and `cntrmask' limit check. * src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_hintmask>: Fix thinko and handle tracing also.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2010-06-27 Werner Lemberg <[email protected]>
+ [cff] Really fix `hintmask' and `cntrmask' limit check.
+
+ * src/cff/cffgload.c (cff_decoder_parse_charstrings)
+ <cff_op_hintmask>: Fix thinko and handle tracing also.
+
+2010-06-27 Werner Lemberg <[email protected]>
+
Fix valgrind warning.
* src/base/ftoutln.c (FT_Outline_Get_Orientation): Initialize
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -1339,16 +1339,16 @@
decoder->num_hints += num_args / 2;
}
- if ( hinter )
- {- /* In a valid charstring there must be at least three bytes */
- /* after `hintmask' or `cntrmask' (two for a `moveto' */
- /* operator and one for `endchar'). Additionally, there */
- /* must be space for `num_hints' bits. */
+ /* In a valid charstring there must be at least three bytes */
+ /* after `hintmask' or `cntrmask' (two for a `moveto' */
+ /* operator and one for `endchar'). Additionally, there */
+ /* must be space for `num_hints' bits. */
- if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
- goto Syntax_Error;
+ if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
+ goto Syntax_Error;
+ if ( hinter )
+ {if ( op == cff_op_hintmask )
hinter->hintmask( hinter->hints,
builder->current->n_points,
@@ -1377,8 +1377,6 @@
#else
ip += ( decoder->num_hints + 7 ) >> 3;
#endif
- if ( ip >= limit )
- goto Syntax_Error;
args = stack;
break;