From 9bd20b7304aae61de5d50ac359cf27132bafd4c1 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 22 Nov 2014 06:24:45 +0100 Subject: [PATCH] [sfnt] Fix Savannah bug #43656. * src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity tests. --- ChangeLog | 7 +++++++ src/sfnt/ttcmap.c | 6 +++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index ee27f70b0..150f65aee 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2014-11-22 Werner Lemberg + + [sfnt] Fix Savannah bug #43656. + + * src/sfnt/ttcmap.c (tt_cmap4_validate): Fix order of validity + tests. + 2014-11-21 Werner Lemberg [type1, type42] Fix Savannah bug #43655. diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c index 712bd4f90..fb863c39e 100644 --- a/src/sfnt/ttcmap.c +++ b/src/sfnt/ttcmap.c @@ -845,9 +845,6 @@ p = table + 2; /* skip format */ length = TT_NEXT_USHORT( p ); - if ( length < 16 ) - FT_INVALID_TOO_SHORT; - /* in certain fonts, the `length' field is invalid and goes */ /* out of bound. We try to correct this here... */ if ( table + length > valid->limit ) @@ -858,6 +855,9 @@ length = (FT_UInt)( valid->limit - table ); } + if ( length < 16 ) + FT_INVALID_TOO_SHORT; + p = table + 6; num_segs = TT_NEXT_USHORT( p ); /* read segCountX2 */