diff options
author | Werner Lemberg <wl@gnu.org> | 2016-07-19 21:35:58 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2016-07-19 21:35:58 +0200 |
commit | 7f63105c072388e5a5674c0caafc7a560e31c95b (patch) | |
tree | 56cc3c41c8833a3066f9f5c6b70f0d255c963164 | |
parent | 9f6426eb16c666c3545faf913af260214205c77c (diff) | |
download | freetype2-7f63105c072388e5a5674c0caafc7a560e31c95b.tar.gz |
[truetype] Sanitizer fix, second try.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Fix boundary
tests and use only one slot more.
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | src/truetype/ttgxvar.c | 8 |
2 files changed, 11 insertions, 4 deletions
@@ -1,5 +1,12 @@ 2016-07-19 Werner Lemberg <wl@gnu.org> + [truetype] Sanitizer fix, second try. + + * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Fix boundary + tests and use only one slot more. + +2016-07-19 Werner Lemberg <wl@gnu.org> + [truetype] Sanitizer fix. * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Increase array diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 033b57f3b..080e2ddce 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -159,9 +159,9 @@ } /* in the nested loops below we increase `i' twice; */ - /* it is faster to simply allocate two more slots */ + /* it is faster to simply allocate one more slot */ /* than to add another test within the loop */ - if ( FT_NEW_ARRAY( points, n + 2 ) ) + if ( FT_NEW_ARRAY( points, n + 1 ) ) return NULL; *point_cnt = n; @@ -182,7 +182,7 @@ { first += FT_GET_USHORT(); points[i++] = first; - if ( i == n ) + if ( i >= n ) break; } } @@ -195,7 +195,7 @@ { first += FT_GET_BYTE(); points[i++] = first; - if ( i == n ) + if ( i >= n ) break; } } |