[cff] Really fix `hintmask' and `cntrmask' limit check.

* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Fix thinko and handle tracing also.

ChangeLog

@@ -1,3 +1,10 @@
+2010-06-27  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Really fix `hintmask' and `cntrmask' limit check.
+
+	* src/cff/cffgload.c (cff_decoder_parse_charstrings)
+	<cff_op_hintmask>: Fix thinko and handle tracing also.
+
 2010-06-27  Werner Lemberg  <wl@gnu.org>
 
 	Fix valgrind warning.

src/cff/cffgload.c

@@ -1339,16 +1339,16 @@
             decoder->num_hints += num_args / 2;
           }
 
-          if ( hinter )
-          {
-            /* In a valid charstring there must be at least three bytes */
-            /* after `hintmask' or `cntrmask' (two for a `moveto'       */
-            /* operator and one for `endchar').  Additionally, there    */
-            /* must be space for `num_hints' bits.                      */
+          /* In a valid charstring there must be at least three bytes */
+          /* after `hintmask' or `cntrmask' (two for a `moveto'       */
+          /* operator and one for `endchar').  Additionally, there    */
+          /* must be space for `num_hints' bits.                      */
 
-            if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
-              goto Syntax_Error;
+          if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
+            goto Syntax_Error;
 
+          if ( hinter )
+          {
             if ( op == cff_op_hintmask )
               hinter->hintmask( hinter->hints,
                                 builder->current->n_points,
@@ -1377,8 +1377,6 @@
 #else
           ip += ( decoder->num_hints + 7 ) >> 3;
 #endif
-          if ( ip >= limit )
-            goto Syntax_Error;
           args = stack;
           break;