diff options
-rw-r--r-- | ChangeLog | 2 | ||||
-rw-r--r-- | src/truetype/ttgxvar.c | 4 |
2 files changed, 3 insertions, 3 deletions
@@ -17,7 +17,7 @@ Fix Ghostscript Coverity issue #3904. * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Protect against - zero value of `runcnt'. + invalid values of `runcnt'. 2009-03-20 Werner Lemberg <wl@gnu.org> diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index cbd401d2b..f6a10d9b7 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -157,7 +157,7 @@ runcnt = runcnt & GX_PT_POINT_RUN_COUNT_MASK; first = points[i++] = FT_GET_USHORT(); - if ( !runcnt ) + if ( runcnt < 1 ) goto Exit; /* first point not included in runcount */ @@ -168,7 +168,7 @@ { first = points[i++] = FT_GET_BYTE(); - if ( !runcnt ) + if ( runcnt < 1 ) goto Exit; for ( j = 0; j < runcnt; ++j ) |