shithub: freetype+ttf2subf

Download patch

ref: 594156586b888805681a7085a780bd743fb180bd
parent: ed7e8194e00ce310905925f9fd10508382fecce6
author: Werner Lemberg <[email protected]>
date: Tue Aug 27 10:07:14 EDT 2019 

[truetype] Prevent crash in `TT_Set_Named_Instance' (#56813).

* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error
handling.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2019-08-27  Werner Lemberg  <[email protected]>
 
+	[truetype] Prevent crash in `TT_Set_Named_Instance' (#56813).
+
+	* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error
+	handling.
+
+2019-08-27  Werner Lemberg  <[email protected]>
+
 	[woff2] Fix compiler warnings.
 
 	* src/sfnt/sfwoff2.c (read_num_hmetrics): Remove unused argument
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -3037,7 +3037,7 @@
   TT_Set_Named_Instance( TT_Face  face,
                          FT_UInt  instance_index )
   {
-    FT_Error    error = FT_ERR( Invalid_Argument );
+    FT_Error    error;
     GX_Blend    blend;
     FT_MM_Var*  mmvar;
 
@@ -3057,7 +3057,10 @@
 
     /* `instance_index' starts with value 1, thus `>' */
     if ( instance_index > num_instances )
+    {
+      error = FT_ERR( Invalid_Argument );
       goto Exit;
+    }
 
     if ( instance_index > 0 )
     {