ref: ec4372f56552b7370d6693db8b4d44d412e2dd6a
parent: fa764cf8687eea54ce7b929eb066f117f51bd6de
author: Werner Lemberg <[email protected]>
date: Thu Nov 18 15:34:22 EST 2010
[truetype] Fix `loca' handling for inconsistent number of glyphs. Reported by Johnson Y. Yan <[email protected]>. * src/truetype/ttpload.c (tt_face_load_loca): While sanitizing, handle case where `loca' is the last table in the font.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
2010-11-18 Werner Lemberg <[email protected]>
+ [truetype] Fix `loca' handling for inconsistent number of glyphs.
+ Reported by Johnson Y. Yan <[email protected]>.
+
+ * src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
+ handle case where `loca' is the last table in the font.
+
+2010-11-18 Werner Lemberg <[email protected]>
+
[sfnt] Ignore all errors while loading `OS/2' table.
Suggested by Johnson Y. Yan <[email protected]>.
--- a/src/truetype/ttpload.c
+++ b/src/truetype/ttpload.c
@@ -4,7 +4,7 @@
/* */
/* TrueType-specific tables loader (body). */
/* */
-/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -137,6 +137,12 @@
dist = diff;
}
+ if ( entry == limit )
+ {+ /* `loca' is the last table */
+ dist = stream->size - pos;
+ }
+
if ( new_loca_len <= dist )
{face->num_locations = face->root.num_glyphs;
@@ -307,7 +313,7 @@
FT_Short* limit = cur + face->cvt_size;
- for ( ; cur < limit; cur++ )
+ for ( ; cur < limit; cur++ )
*cur = FT_GET_SHORT();
}