ref: e0ed07d7674a767b73c69182a4d74ed0bc95cd7e
parent: f31072c867c7610e462fbaa8a2a6b6166accfbe7
author: Werner Lemberg <[email protected]>
date: Tue Nov 4 05:37:30 EST 2008
* src/type1/t1load.c (parse_subrs): Use an endless loop. There are fonts (like HELVI.PFB version 003.001, used on OS/2) which define some `subrs' elements more than once. Problem reported by Peter Weilbacher <[email protected]>.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2008-11-03 Werner Lemberg <[email protected]>
+
+ * src/type1/t1load.c (parse_subrs): Use an endless loop. There are
+ fonts (like HELVI.PFB version 003.001, used on OS/2) which define
+ some `subrs' elements more than once. Problem reported by Peter
+ Weilbacher <[email protected]>.
+
2008-10-15 Graham Asher <[email protected]>
* src/sfnt/ttpost.c (tt_post_default_names): Add `const'.
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -179,7 +179,7 @@
if ( table->cursor + length > table->capacity )
{FT_Error error;
- FT_Offset new_size = table->capacity;
+ FT_Offset new_size = table->capacity;
FT_Long in_offset;
@@ -376,7 +376,7 @@
/* skip octal escape or ignore backslash */
for ( i = 0; i < 3 && cur < limit; ++i )
{- if ( ! IS_OCTAL_DIGIT( *cur ) )
+ if ( !IS_OCTAL_DIGIT( *cur ) )
break;
++cur;
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1330,9 +1330,9 @@
PS_Table table = &loader->subrs;
FT_Memory memory = parser->root.memory;
FT_Error error;
- FT_Int n, num_subrs;
+ FT_Int num_subrs;
- PSAux_Service psaux = (PSAux_Service)face->psaux;
+ PSAux_Service psaux = (PSAux_Service)face->psaux;
T1_Skip_Spaces( parser );
@@ -1366,18 +1366,17 @@
goto Fail;
}
- /* the format is simple: */
- /* */
- /* `index' + binary data */
- /* */
- for ( n = 0; n < num_subrs; n++ )
+ /* the format is simple: */
+ /* */
+ /* `index' + binary data */
+ /* */
+ for (;;)
{FT_Long idx, size;
FT_Byte* base;
- /* If the next token isn't `dup', we are also done. This */
- /* happens when there are `holes' in the Subrs array. */
+ /* If the next token isn't `dup' we are done. */
if ( ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
break;