shithub: freetype+ttf2subf

Download patch

ref: eb22ef26d94a8bebb2cfd68306c6ba4ee679517e
parent: 7e6c321a58c14c33b8885d4839cb21a6ac442a07
author: Werner Lemberg <[email protected]>
date: Tue Aug 4 02:50:04 EDT 2015 

Another left-shift bug (#45681).

* src/base/ftobjs.c (IsMacBinary): Only accept positive values for
`dlen'.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2015-08-04  Werner Lemberg  <[email protected]>
+
+	Another left-shift bug (#45681).
+
+	* src/base/ftobjs.c (IsMacBinary): Only accept positive values for
+	`dlen'.
+
 2015-08-03  Alexei Podtelezhnikov  <[email protected]>
 
 	[base] Fix `ft_corner_orientation'.
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1889,13 +1889,14 @@
     if ( error )
       goto Exit;
 
-    if (            header[ 0] !=  0 ||
-                    header[74] !=  0 ||
-                    header[82] !=  0 ||
-                    header[ 1] ==  0 ||
-                    header[ 1] >  33 ||
-                    header[63] !=  0 ||
-         header[2 + header[1]] !=  0 )
+    if (            header[ 0] !=   0 ||
+                    header[74] !=   0 ||
+                    header[82] !=   0 ||
+                    header[ 1] ==   0 ||
+                    header[ 1] >   33 ||
+                    header[63] !=   0 ||
+         header[2 + header[1]] !=   0 ||
+                  header[0x53] > 0x7F )
       return FT_THROW( Unknown_File_Format );
 
     dlen = ( header[0x53] << 24 ) |