diff options
| author | Werner Lemberg <wl@gnu.org> | 2010-11-18 20:34:22 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2010-11-18 20:34:22 +0100 |
| commit | ec4372f56552b7370d6693db8b4d44d412e2dd6a (patch) | |
| tree | 9a45fe6a9b4a9a8a72d78ea9d4cb3343fec52a49 | |
| parent | fa764cf8687eea54ce7b929eb066f117f51bd6de (diff) | |
| download | freetype2-ec4372f56552b7370d6693db8b4d44d412e2dd6a.tar.gz | |
[truetype] Fix `loca' handling for inconsistent number of glyphs.
Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>.
* src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
handle case where `loca' is the last table in the font.
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | src/truetype/ttpload.c | 10 |
2 files changed, 16 insertions, 2 deletions
@@ -1,5 +1,13 @@ 2010-11-18 Werner Lemberg <wl@gnu.org> + [truetype] Fix `loca' handling for inconsistent number of glyphs. + Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>. + + * src/truetype/ttpload.c (tt_face_load_loca): While sanitizing, + handle case where `loca' is the last table in the font. + +2010-11-18 Werner Lemberg <wl@gnu.org> + [sfnt] Ignore all errors while loading `OS/2' table. Suggested by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>. diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index c53173359..68a545315 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -4,7 +4,7 @@ /* */ /* TrueType-specific tables loader (body). */ /* */ -/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by */ +/* Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -137,6 +137,12 @@ dist = diff; } + if ( entry == limit ) + { + /* `loca' is the last table */ + dist = stream->size - pos; + } + if ( new_loca_len <= dist ) { face->num_locations = face->root.num_glyphs; @@ -307,7 +313,7 @@ FT_Short* limit = cur + face->cvt_size; - for ( ; cur < limit; cur++ ) + for ( ; cur < limit; cur++ ) *cur = FT_GET_SHORT(); } |