diff options
Diffstat (limited to 'src/sfnt/ttcolr.c')
| -rw-r--r-- | src/sfnt/ttcolr.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c index 1277bbd53..ad0f1278a 100644 --- a/src/sfnt/ttcolr.c +++ b/src/sfnt/ttcolr.c @@ -481,7 +481,9 @@ iterator->p = colr->layers + offset; } - if ( iterator->layer >= iterator->num_layers ) + if ( iterator->layer >= iterator->num_layers || + iterator->p < colr->layers || + iterator->p >= ( (FT_Byte*)colr->table + colr->table_size ) ) return 0; *aglyph_index = FT_NEXT_USHORT( iterator->p ); |