From 655b059764387238d83da7ecddf07ecfe214af9f Mon Sep 17 00:00:00 2001 From: Owen Taylor Date: Mon, 30 Jun 2003 13:08:58 +0000 Subject: 2003-06-25 Owen Taylor * src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign num_records until we actually decide to load the table, otherwise, we'll segfault in tt_face_free_hdmx. --- ChangeLog | 6 ++++++ src/sfnt/ttload.c | 6 ++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 97565422c..fc5d99865 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2003-06-25 Owen Taylor + + * src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign + num_records until we actually decide to load the table, + otherwise, we'll segfault in tt_face_free_hdmx. + 2003-06-24 Werner Lemberg * src/cff/cffdrivr.c (cff_get_glyph_name): Protect agains zero diff --git a/src/sfnt/ttload.c b/src/sfnt/ttload.c index bea78d4f4..13b7e8677 100644 --- a/src/sfnt/ttload.c +++ b/src/sfnt/ttload.c @@ -1776,6 +1776,7 @@ FT_Memory memory = stream->memory; TT_Hdmx hdmx = &face->hdmx; + FT_Short num_records; FT_Long num_glyphs; FT_Long record_size; @@ -1793,7 +1794,7 @@ goto Exit; hdmx->version = FT_GET_USHORT(); - hdmx->num_records = FT_GET_SHORT(); + num_records = FT_GET_SHORT(); record_size = FT_GET_LONG(); FT_FRAME_EXIT(); @@ -1802,9 +1803,10 @@ if ( hdmx->version != 0 ) goto Exit; - if ( FT_NEW_ARRAY( hdmx->records, hdmx->num_records ) ) + if ( FT_NEW_ARRAY( hdmx->records, num_records ) ) goto Exit; + hdmx->num_records = num_records; num_glyphs = face->root.num_glyphs; record_size -= num_glyphs + 2; -- cgit v1.2.1