diff --git a/ChangeLog b/ChangeLog index 5988dcb0c..c01ecb8cc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2010-06-26 Werner Lemberg + + Fix PFR change 2010-06-24. + + * src/pfr/pfrgload.c (pfr_glyph_load_simple): Really protect against + invalid indices. + 2010-06-26 Werner Lemberg Improve PFR tracing messages. diff --git a/src/pfr/pfrgload.c b/src/pfr/pfrgload.c index 2dd6a916e..6f65b01f5 100644 --- a/src/pfr/pfrgload.c +++ b/src/pfr/pfrgload.c @@ -268,8 +268,8 @@ { PFR_CHECK( 1 ); count = PFR_NEXT_BYTE( p ); - x_count = ( count & 15 ); - y_count = ( count >> 4 ); + x_count = count & 15; + y_count = count >> 4; } else { @@ -388,7 +388,7 @@ case 2: /* horizontal line to */ FT_TRACE6(( "- horizontal line to cx.%d", format_low )); - if ( format_low > x_count || x_count == 0 ) + if ( format_low >= x_count ) goto Failure; pos[0].x = glyph->x_control[format_low]; pos[0].y = pos[3].y; @@ -398,7 +398,7 @@ case 3: /* vertical line to */ FT_TRACE6(( "- vertical line to cy.%d", format_low )); - if ( format_low > y_count || y_count == 0 ) + if ( format_low >= y_count ) goto Failure; pos[0].x = pos[3].x; pos[0].y = glyph->y_control[format_low]; @@ -440,7 +440,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > x_count || x_count == 0 ) + if ( idx >= x_count ) goto Failure; cur->x = glyph->x_control[idx]; FT_TRACE7(( " cx#%d", idx )); @@ -470,7 +470,7 @@ case 0: /* 8-bit index */ PFR_CHECK( 1 ); idx = PFR_NEXT_BYTE( p ); - if ( idx > y_count || y_count == 0 ) + if ( idx >= y_count ) goto Failure; cur->y = glyph->y_control[idx]; FT_TRACE7(( " cy#%d", idx ));