* src/sfnt/ttmtx.c (tt_face_get_metrics)

18 years ago · 011d111218
parent b800329782
commit 011d111218
2 changed files with 7 additions and 2 deletions
--- a/5
+++ b/5
@ -1,3 +1,8 @@
+2007-01-21  Werner Lemberg  <wl@gnu.org>
+
+	* src/sfnt/ttmtx.c (tt_face_get_metrics)
+	[!FT_CONFIG_OPTION_OLD_INTERNALS]: Fix limit check.
+
 2007-01-17  Werner Lemberg  <wl@gnu.org>


--- a/src/sfnt/ttmtx.c
+++ b/src/sfnt/ttmtx.c
@ -368,11 +368,11 @@
      if ( gindex < (FT_UInt)k )
      {
        table_pos += 4 * gindex;
-        if ( table_pos + 6 > table_end )
+        if ( table_pos + 4 > table_end )
          goto NoData;

        if ( FT_STREAM_SEEK( table_pos ) ||
-             FT_READ_USHORT( *aadvance)  ||
+             FT_READ_USHORT( *aadvance ) ||
             FT_READ_SHORT( *abearing )  )
          goto NoData;
      }