Fix overallocating bug in FT_Outline_New_Internal().

15 years ago · 93eaf50aae
parent 63e7aac34f
commit 93eaf50aae
2 changed files with 12 additions and 3 deletions
--- a/9
+++ b/9
@ -1,3 +1,12 @@
+2010-02-12  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	Fix overallocating bug in FT_Outline_New_Internal().
+
+	* src/base/ftoutln.c (FT_Outline_New_Internal): The length of
+	FT_Outline->points[] should be numPoints, not 2 * numPoints.
+	Found by Paul Messmer, see
+	http://lists.gnu.org/archive/html/freetype-devel/2010-02/msg00003.html
+
 2010-02-10  Ken Sharp  <ken.sharp@artifex.com>

 	Really fix Savannah bug #28678 (part 2).
--- a/src/base/ftoutln.c
+++ b/src/base/ftoutln.c
@ -304,9 +304,9 @@

    *anoutline = null_outline;

-    if ( FT_NEW_ARRAY( anoutline->points,   numPoints * 2L ) ||
-         FT_NEW_ARRAY( anoutline->tags,     numPoints      ) ||
-         FT_NEW_ARRAY( anoutline->contours, numContours    ) )
+    if ( FT_NEW_ARRAY( anoutline->points,   numPoints   ) ||
+         FT_NEW_ARRAY( anoutline->tags,     numPoints   ) ||
+         FT_NEW_ARRAY( anoutline->contours, numContours ) )
      goto Fail;

    anoutline->n_points    = (FT_UShort)numPoints;