shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

In cid_read_subrs, decode subroutines only if lenIV >= 0.

git/fs: mount .git/fs: mount/attach disallowed

--- a/src/cid/cidload.c

+++ b/src/cid/cidload.c

@@ -413,7 +413,8 @@

     subr = face->subrs;

     for ( n = 0; n < cid->num_dicts; n++, subr++ )

     {

-      CID_FontDict*  dict = cid->font_dicts + n;

+      CID_FontDict*  dict  = cid->font_dicts + n;

+      FT_Int         lenIV = dict->private_dict.lenIV;

       FT_UInt        count, num_subrs = dict->num_subrs;

       FT_ULong       data_len;

       FT_Byte*       p;

@@ -464,14 +465,17 @@

         subr->code[count] = subr->code[count - 1] + len;

       }

-      /* decrypt subroutines */

-      for ( count = 0; count < num_subrs; count++ )

+      /* decrypt subroutines, but only if lenIV >= 0. */

+      if ( lenIV >= 0 )

       {

-        FT_UInt  len;

+        for ( count = 0; count < num_subrs; count++ )

+        {

+          FT_UInt  len;

-        len = offsets[count + 1] - offsets[count];

-        cid_decrypt( subr->code[count], len, 4330 );

+          len = offsets[count + 1] - offsets[count];

+          cid_decrypt( subr->code[count], len, 4330 );

+        }

       }

       subr->num_subrs = num_subrs;