shithub: freetype+ttf2subf

Download patch

ref: 7d35a7dc7cc621538a1f4a63c83ebf223aace0b0
parent: d9c1659610f9cd5e103790cb5963483d65cf0d2d
author: Werner Lemberg <[email protected]>
date: Thu Mar 1 11:11:33 EST 2012 

[winfonts] Fix Savannah bug #35659.

* src/winfonts/winfnt.c (FNT_Face_Init): Check number of glyphs.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2012-03-01  Werner Lemberg  <[email protected]>
 
+	[winfonts] Fix Savannah bug #35659.
+
+	* src/winfonts/winfnt.c (FNT_Face_Init): Check number of glyphs.
+
+2012-03-01  Werner Lemberg  <[email protected]>
+
 	[bdf] Fix Savannah bug #35658.
 
 	* src/bdf/bdflib.c (_bdf_list_split): Initialize `field' elements
--- a/src/winfonts/winfnt.c
+++ b/src/winfonts/winfnt.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType font driver for Windows FNT/FON files                       */
 /*                                                                         */
-/*  Copyright 1996-2004, 2006-2011 by                                      */
+/*  Copyright 1996-2004, 2006-2012 by                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*  Copyright 2003 Huw D M Davies for Codeweavers                          */
 /*  Copyright 2007 Dmitry Timoshkov for Codeweavers                        */
@@ -831,7 +831,14 @@
           root->charmap = root->charmaps[0];
       }
 
-      /* setup remaining flags */
+      /* set up remaining flags */
+
+      if ( font->header.last_char < font->header.first_char )
+      {
+        FT_TRACE2(( "invalid number of glyphs\n" ));
+        error = FNT_Err_Invalid_File_Format;
+        goto Fail;
+      }
 
       /* reserve one slot for the .notdef glyph at index 0 */
       root->num_glyphs = font->header.last_char -