[truetype] Fix Savannah bug #38211.

* src/truetype/ttinterp.c (Ins_IP): Make FreeType behave identical
to other interpreters if rp1 == rp2 (which is invalid).

2 files changed, 19 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index aa5d62c2d..466129b8e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2013-02-01  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Fix Savannah bug #38211.
+
+	* src/truetype/ttinterp.c (Ins_IP): Make FreeType behave identical
+	to other interpreters if rp1 == rp2 (which is invalid).
+
 2013-01-28  Alexei Podtelezhnikov  <apodtele@gmail.com>
 
 	[base] Small optimization of BBox calculation.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index d1fd80584..4e4a5bfbe 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -6974,9 +6974,18 @@
       cur_dist = CUR_Func_project ( &CUR.zp2.cur[point], cur_base );
 
       if ( org_dist )
-        new_dist = ( old_range != 0 )
-                     ? FT_MulDiv( org_dist, cur_range, old_range )
-                     : cur_dist;
+      {
+        if ( old_range )
+          new_dist = FT_MulDiv( org_dist, cur_range, old_range );
+        else
+        {
+          /* use the middle position */
+          new_dist = cur_dist -
+                     CUR_fast_dualproj( &CUR.zp2.cur[point] ) +
+                     ( CUR_fast_dualproj( &CUR.zp1.cur[CUR.GS.rp1] ) +
+                       CUR_fast_dualproj( &CUR.zp1.cur[CUR.GS.rp2] ) ) / 2;
+        }
+      }
       else
         new_dist = 0;