diff options
| author | Werner Lemberg <wl@gnu.org> | 2009-03-21 07:48:34 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2009-03-21 07:48:34 +0100 |
| commit | 16bd51c81929354a88a0ea0df04e08e5d8bffd04 (patch) | |
| tree | ae23cea1aff156a9cefda5992ae7ff513bc27b62 | |
| parent | 7171ff57822a07e52728ce1556ca45bfc55c337b (diff) | |
| download | freetype2-16bd51c81929354a88a0ea0df04e08e5d8bffd04.tar.gz | |
Fix Ghostscript Coverity issue #3904.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against
zero value of `runcnt'.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/truetype/ttgxvar.c | 58 |
2 files changed, 40 insertions, 25 deletions
@@ -1,3 +1,10 @@ +2009-03-21 Werner Lemberg <wl@gnu.org> + + Fix Ghostscript Coverity issue #3904. + + * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against + zero value of `runcnt'. + 2009-03-20 Werner Lemberg <wl@gnu.org> Fix `make multi' run. diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 515e734b8..e5888170a 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -4,7 +4,7 @@ /* */ /* TrueType GX Font Variation loader */ /* */ -/* Copyright 2004, 2005, 2006, 2007, 2008 by */ +/* Copyright 2004, 2005, 2006, 2007, 2008, 2009 by */ /* David Turner, Robert Wilhelm, Werner Lemberg, and George Williams. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -16,30 +16,31 @@ /***************************************************************************/ -/***************************************************************************/ -/* */ -/* Apple documents the `fvar', `gvar', `cvar', and `avar' tables at */ -/* */ -/* http://developer.apple.com/fonts/TTRefMan/RM06/Chap6[fgca]var.html */ -/* */ -/* The documentation for `fvar' is inconsistent. At one point it says */ -/* that `countSizePairs' should be 3, at another point 2. It should be 2. */ -/* */ -/* The documentation for `gvar' is not intelligible; `cvar' refers you to */ -/* `gvar' and is thus also incomprehensible. */ -/* */ -/* The documentation for `avar' appears correct, but Apple has no fonts */ -/* with an `avar' table, so it is hard to test. */ -/* */ -/* Many thanks to John Jenkins (at Apple) in figuring this out. */ -/* */ -/* */ -/* Apple's `kern' table has some references to tuple indices, but as there */ -/* is no indication where these indices are defined, nor how to */ -/* interpolate the kerning values (different tuples have different */ -/* classes) this issue is ignored. */ -/* */ -/***************************************************************************/ + /*************************************************************************/ + /* */ + /* Apple documents the `fvar', `gvar', `cvar', and `avar' tables at */ + /* */ + /* http://developer.apple.com/fonts/TTRefMan/RM06/Chap6[fgca]var.html */ + /* */ + /* The documentation for `fvar' is inconsistent. At one point it says */ + /* that `countSizePairs' should be 3, at another point 2. It should */ + /* be 2. */ + /* */ + /* The documentation for `gvar' is not intelligible; `cvar' refers you */ + /* to `gvar' and is thus also incomprehensible. */ + /* */ + /* The documentation for `avar' appears correct, but Apple has no fonts */ + /* with an `avar' table, so it is hard to test. */ + /* */ + /* Many thanks to John Jenkins (at Apple) in figuring this out. */ + /* */ + /* */ + /* Apple's `kern' table has some references to tuple indices, but as */ + /* there is no indication where these indices are defined, nor how to */ + /* interpolate the kerning values (different tuples have different */ + /* classes) this issue is ignored. */ + /* */ + /*************************************************************************/ #include <ft2build.h> @@ -158,6 +159,9 @@ runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; first = points[i++] = FT_GET_USHORT(); + if ( !runcnt ) + goto Exit; + /* first point not included in runcount */ for ( j = 0; j < runcnt; ++j ) points[i++] = (FT_UShort)( first += FT_GET_USHORT() ); @@ -166,11 +170,15 @@ { first = points[i++] = FT_GET_BYTE(); + if ( !runcnt ) + goto Exit; + for ( j = 0; j < runcnt; ++j ) points[i++] = (FT_UShort)( first += FT_GET_BYTE() ); } } + Exit: return points; } |