[truetype] Prevent crash in `TT_Set_Named_Instance' (#56813).

* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error handling.
5 years ago · 594156586b
parent ed7e8194e0
commit 594156586b
2 changed files with 11 additions and 1 deletions
--- a/7
+++ b/7
@ -1,3 +1,10 @@
+2019-08-27  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Prevent crash in `TT_Set_Named_Instance' (#56813).
+
+	* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Fix error
+	handling.
+
 2019-08-27  Werner Lemberg  <wl@gnu.org>

 	[woff2] Fix compiler warnings.
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@ -3037,7 +3037,7 @@
  TT_Set_Named_Instance( TT_Face  face,
                         FT_UInt  instance_index )
  {
-    FT_Error    error = FT_ERR( Invalid_Argument );
+    FT_Error    error;
    GX_Blend    blend;
    FT_MM_Var*  mmvar;

@ -3057,7 +3057,10 @@

    /* `instance_index' starts with value 1, thus `>' */
    if ( instance_index > num_instances )
+    {
+      error = FT_ERR( Invalid_Argument );
      goto Exit;
+    }

    if ( instance_index > 0 )
    {