Bug 698042: xps: fix glyph index and index bounds check.

If a gs_glyph has the GS_MIN_GLYPH_INDEX offset, we need to remove the offset
before we try to use it.

Secondly, using a unsigned variable for a value from which we subtract 1, and
which can be zero doesn't work well. Switch to a signed value.

1 files changed, 7 insertions, 3 deletions

diff --git a/xps/xpsttf.c b/xps/xpsttf.c
index ba2e6835c..f7a289f9e 100644
--- a/xps/xpsttf.c
+++ b/xps/xpsttf.c
@@ -141,10 +141,14 @@ xps_true_callback_glyph_name(gs_font *pfont, gs_glyph glyph, gs_const_string *ps
     int table_offset;
 
     ulong format;
-    uint numGlyphs;
+    int numGlyphs;
     uint glyph_name_index;
     const byte *postp; /* post table pointer */
 
+    if (glyph >= GS_MIN_GLYPH_INDEX) {
+        glyph -= GS_MIN_GLYPH_INDEX;
+    }
+
     /* guess if the font type is not truetype */
     if ( pfont->FontType != ft_TrueType )
     {
@@ -193,8 +197,8 @@ xps_true_callback_glyph_name(gs_font *pfont, gs_glyph glyph, gs_const_string *ps
     }
 
     /* skip over the post header */
-    numGlyphs = u16(postp + 32);
-    if (glyph > numGlyphs - 1)
+    numGlyphs = (int)u16(postp + 32);
+    if ((int)glyph > numGlyphs - 1)
     {
         return gs_throw1(-1, "glyph index %lu out of range", (ulong)glyph);
     }