ref: 2c8530bd3d61badeeeadaf120079c00084936d88
parent: 3c41447eefd73607be1b2c9719bc10e3fe709f5f
author: Owen Taylor <[email protected]>
date: Mon Jun 30 09:08:58 EDT 2003
2003-06-25 Owen Taylor <[email protected]>
* src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign
num_records until we actually decide to load the table,
otherwise, we'll segfault in tt_face_free_hdmx.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2003-06-25 Owen Taylor <[email protected]>
+
+ * src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign
+ num_records until we actually decide to load the table,
+ otherwise, we'll segfault in tt_face_free_hdmx.
+
2003-06-24 Werner Lemberg <[email protected]>
* src/cff/cffdrivr.c (cff_get_glyph_name): Protect agains zero
--- a/src/sfnt/ttload.c
+++ b/src/sfnt/ttload.c
@@ -1776,6 +1776,7 @@
FT_Memory memory = stream->memory;
TT_Hdmx hdmx = &face->hdmx;
+ FT_Short num_records;
FT_Long num_glyphs;
FT_Long record_size;
@@ -1793,7 +1794,7 @@
goto Exit;
hdmx->version = FT_GET_USHORT();
- hdmx->num_records = FT_GET_SHORT();
+ num_records = FT_GET_SHORT();
record_size = FT_GET_LONG();
FT_FRAME_EXIT();
@@ -1802,9 +1803,10 @@
if ( hdmx->version != 0 )
goto Exit;
- if ( FT_NEW_ARRAY( hdmx->records, hdmx->num_records ) )
+ if ( FT_NEW_ARRAY( hdmx->records, num_records ) )
goto Exit;
+ hdmx->num_records = num_records;
num_glyphs = face->root.num_glyphs;
record_size -= num_glyphs + 2;