ref: 3cf87f4d278c7ae5ae91f13936ea076a5a57e2bb
parent: b21d7bc567c41d27cf64673136a42664ab5fac8b
author: Werner Lemberg <[email protected]>
date: Thu Jun 24 04:20:56 EDT 2010
Fix Savannah bug #30235. * src/pfr/pfrgload.c (pfr_glyph_load_simple): Protect against invalid indices if there aren't any coordinates for indexing.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2010-06-24 Werner Lemberg <[email protected]>
+ Fix Savannah bug #30235.
+
+ * src/pfr/pfrgload.c (pfr_glyph_load_simple): Protect against
+ invalid indices if there aren't any coordinates for indexing.
+
+2010-06-24 Werner Lemberg <[email protected]>
+
[bdf]: Font properties are optional.
* src/bdf/bdflib.c (_bdf_readstream): Use special error code to
--- a/src/pfr/pfrgload.c
+++ b/src/pfr/pfrgload.c
@@ -388,7 +388,7 @@
case 2: /* horizontal line to */
FT_TRACE6(( "- horizontal line to cx.%d", format_low ));
- if ( format_low > x_count )
+ if ( format_low > x_count || x_count == 0 )
goto Failure;
pos[0].x = glyph->x_control[format_low];
pos[0].y = pos[3].y;
@@ -398,7 +398,7 @@
case 3: /* vertical line to */
FT_TRACE6(( "- vertical line to cy.%d", format_low ));
- if ( format_low > y_count )
+ if ( format_low > y_count || y_count == 0 )
goto Failure;
pos[0].x = pos[3].x;
pos[0].y = glyph->y_control[format_low];
@@ -440,7 +440,7 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
- if ( idx > x_count )
+ if ( idx > x_count || x_count == 0 )
goto Failure;
cur->x = glyph->x_control[idx];
FT_TRACE7(( " cx#%d", idx ));
@@ -470,7 +470,7 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
- if ( idx > y_count )
+ if ( idx > y_count || y_count == 0 )
goto Failure;
cur->y = glyph->y_control[idx];
FT_TRACE7(( " cy#%d", idx ));