shithub: freetype+ttf2subf

Download patch

ref: 1b6f1d20b552aadeb4dabd3514e876ca9294cce4
parent: 6dc27526a97bfc8889840454205e030e4b3051d9
author: suzuki toshiya <[email protected]>
date: Fri Jul 31 20:32:16 EDT 2009 

truetype: Truncate the instructions upto 16-bit per a glyph.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2009-07-31  suzuki toshiya <[email protected]>
 
+	truetype: Truncate the instructions upto 16-bit per a glyph.
+
+	* src/truetype/ttgload.c (TT_Hint_Glyph): Truncate
+	the instructions upto 16-bit length per a glyph.
+
+2009-07-31  suzuki toshiya <[email protected]>
+
 	truetype: Cast the numerical operands to 32-bit for LP64 systems.
 
 	* src/truetype/ttinterp.c (Ins_SPHIX, INS_MIAP,
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -633,7 +633,13 @@
 
 
 #ifdef TT_USE_BYTECODE_INTERPRETER
-    n_ins = loader->glyph->control_len;
+    if ( loader->glyph->control_len > 0xFFFFL )
+    {
+      FT_TRACE1(( "TT_Hint_Glyph: too long instructions " ));
+      FT_TRACE1(( "(0x%lx byte) is truncated\n",
+                 loader->glyph->control_len ));
+    }
+    n_ins = (FT_UInt)( loader->glyph->control_len );
 #endif
 
     origin = zone->cur[zone->n_points - 4].x;