From dd89710f0f643eb0f99a3830e0712d26c7642acd Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Fri, 21 Nov 2014 22:19:28 +0100
Subject: [type1, type42] Fix Savannah bug #43655.

* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
(t42_parse_charstrings): Fix boundary testing.
---
 src/type42/t42parse.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/type42')

diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
index 9b668889b..a60e216f9 100644
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@@ -858,7 +858,7 @@
         FT_PtrDist  len;
 
 
-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
         {
           FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
           error = FT_THROW( Invalid_File_Format );
-- 
cgit v1.2.1