shithub: freetype+ttf2subf

Download patch

ref: dd89710f0f643eb0f99a3830e0712d26c7642acd
parent: b1fc00d5dc0e89432c58367477b6d9d63b6b0be9
author: Werner Lemberg <[email protected]>
date: Fri Nov 21 17:19:28 EST 2014 

[type1, type42] Fix Savannah bug #43655.

* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Fix boundary testing.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2014-11-21  Werner Lemberg  <[email protected]>
 
+	[type1, type42] Fix Savannah bug #43655.
+
+	* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
+	(t42_parse_charstrings): Fix boundary testing.
+
+2014-11-21  Werner Lemberg  <[email protected]>
+
 	* src/pcf/pcfread.c (pcf_get_metrics): Sanitize invalid metrics.
 
 2014-11-21  Werner Lemberg  <[email protected]>
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1604,7 +1604,7 @@
         FT_PtrDist  len;
 
 
-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
         {
           error = FT_THROW( Invalid_File_Format );
           goto Fail;
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -858,7 +858,7 @@
         FT_PtrDist  len;
 
 
-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
         {
           FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
           error = FT_THROW( Invalid_File_Format );