* src/truetype/ttgxvar.c (tt_face_vary_cvt): Add size guard (#52688).

7 years ago · 2fe272aca6
parent d062c54ce7
commit 2fe272aca6
2 changed files with 8 additions and 1 deletions
--- a/4
+++ b/4
@ -1,3 +1,7 @@
+2017-12-18  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgxvar.c (tt_face_vary_cvt): Add size guard (#52688).
+
 2017-12-18  Werner Lemberg  <wl@gnu.org>

 	[truetype] Fix previous commit.
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@ -3110,7 +3110,10 @@
                                        table_len,
                                        point_count == 0 ? face->cvt_size
                                                         : point_count );
-      if ( !points || !deltas )
+
+      if ( !points                                                        ||
+           !deltas                                                        ||
+           ( localpoints == ALL_POINTS && point_count != face->cvt_size ) )
        ; /* failure, ignore it */

      else if ( localpoints == ALL_POINTS )