diff options
| author | Werner Lemberg <wl@gnu.org> | 2010-07-08 07:29:42 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2010-07-08 07:29:42 +0200 |
| commit | 888cd1843e935fe675cf2ac303116d4ed5b9d54b (patch) | |
| tree | 03609c9f9237b6c36bed855cd4c22a3fc32645eb | |
| parent | c73e160517fafd8e1dae498e40035e06e7eb3c04 (diff) | |
| download | freetype2-888cd1843e935fe675cf2ac303116d4ed5b9d54b.tar.gz | |
Fix Savannah bug #30361.
* src/truetype/ttinterp.c (Ins_IUP): Fix bounds check.
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | src/truetype/ttinterp.c | 4 |
2 files changed, 8 insertions, 2 deletions
@@ -1,3 +1,9 @@ +2010-07-08 Werner Lemberg <wl@gnu.org> + + Fix Savannah bug #30361. + + * src/truetype/ttinterp.c (Ins_IUP): Fix bounds check. + 2010-07-06 Werner Lemberg <wl@gnu.org> Pacify compiler. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index f729eaf5e..3e108f4e3 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -6755,8 +6755,8 @@ end_point = CUR.pts.contours[contour] - CUR.pts.first_point; first_point = point; - if ( CUR.pts.n_points <= end_point ) - end_point = CUR.pts.n_points; + if ( BOUNDS ( end_point, CUR.pts.n_points ) ) + end_point = CUR.pts.n_points - 1; while ( point <= end_point && ( CUR.pts.tags[point] & mask ) == 0 ) point++; |