truetype: Truncate the instructions upto 16-bit per a glyph.

2 files changed, 14 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 48a047127..ea96cbcf8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2009-07-03  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
 
+	truetype: Truncate the instructions upto 16-bit per a glyph.
+
+	* src/truetype/ttgload.c (TT_Hint_Glyph): Truncate
+	the instructions upto 16-bit length per a glyph.
+
+2009-07-03  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
 	truetype: Cast the numerical operands to 32-bit for LP64 systems.
 
 	* src/truetype/ttinterp.c (Ins_SPHIX, INS_MIAP,
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 2a0e5d3fb..5d48e8fa3 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -633,7 +633,13 @@
 
 
 #ifdef TT_USE_BYTECODE_INTERPRETER
-    n_ins = loader->glyph->control_len;
+    if ( loader->glyph->control_len > 0xFFFFL )
+    {
+      FT_TRACE1(( "TT_Hint_Glyph: too long instructions " ));
+      FT_TRACE1(( "(0x%lx byte) is truncated\n",
+                 loader->glyph->control_len ));
+    }
+    n_ins = (FT_UInt)( loader->glyph->control_len );
 #endif
 
     origin = zone->cur[zone->n_points - 4].x;