shithub: freetype+ttf2subf

Download patch

ref: c46b1e2476cc1804c0dd25d463be3c99d58befd7
parent: f095744d2db48eddc79bc744c3286e26ebd2c694
author: Werner Lemberg <[email protected]>
date: Fri Jul 8 09:46:42 EDT 2011 

[psaux] Add better argument check for `callothersubr'.

* src/psaux/t1decode.c (t1_decoder_parse_charstrings)
<op_callothersubr>: Reject negative arguments.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2011-07-08  Werner Lemberg  <[email protected]>
+
+	[psaux] Add better argument check for `callothersubr'.
+
+	* src/psaux/t1decode.c (t1_decoder_parse_charstrings)
+	<op_callothersubr>: Reject negative arguments.
+
 2011-07-07  Werner Lemberg  <[email protected]>
 
 	[sfnt] Try harder to find non-zero values for ascender and descender.
--- a/src/psaux/t1decode.c
+++ b/src/psaux/t1decode.c
@@ -4,8 +4,7 @@
 /*                                                                         */
 /*    PostScript Type 1 decoding routines (body).                          */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009    */
-/*            2010 by                                                      */
+/*  Copyright 2000-2011 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -686,6 +685,9 @@
 
         subr_no = (FT_Int)( top[1] >> 16 );
         arg_cnt = (FT_Int)( top[0] >> 16 );
+
+        if ( arg_cnt < 0 || subr_no < 0 )
+          goto Unexpected_OtherSubr;
 
         /***********************************************************/
         /*                                                         */