shithub: freetype+ttf2subf

Download patch

ref: fea68c680017286953caccd14ecb5188a732d0e6
parent: 936d2e072b17375262bc78ecd917fc1c8a44f453
author: David Turner <[email protected]>
date: Fri May 26 02:40:49 EDT 2000

fixed two minor bugs:
  - the glyph index was not checked in FT_Load_Glyph
  - the "type1" driver didn't read the FontBBox and FontMatrix
    correctly..

git/fs: mount .git/fs: mount/attach disallowed
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -1813,6 +1813,9 @@
     if ( !face || !face->size || !face->glyph )
       return FT_Err_Invalid_Face_Handle;
 
+    if ( glyph_index >= face->num_glyphs )
+      return FT_Err_Invalid_Argument;
+      
     driver = face->driver;
 
     /* when the flag NO_RECURSE is set, we disable hinting and scaling */
--- a/src/type1/t1parse.c
+++ b/src/type1/t1parse.c
@@ -512,7 +512,7 @@
     {
       /* get rid of '['/']', or '{'/'}' */
       T1_Byte*  base  = parser->tokenizer->base + token->start + 1;
-      T1_Byte*  limit = base + token->len - 1;
+      T1_Byte*  limit = base + token->len - 2;
       T1_Byte*  cur;
       T1_Byte*  start;
 
@@ -564,7 +564,7 @@
     {
       /* get rid of '[' and ']' */
       T1_Byte*  base  = parser->tokenizer->base + token->start + 1;
-      T1_Byte*  limit = base + token->len - 1;
+      T1_Byte*  limit = base + token->len - 2;
       T1_Byte*  cur;
       T1_Byte*  start;
       T1_Int    n;