In function parse_charstrings, changed code for placing .notdef glyph

into slot 0 so that we no longer have a memory access violation.

src/type1/t1load.c

@@ -1044,7 +1044,7 @@
             len = (FT_Int)( cur2 - cur - 1 );
 
             parser->root.error = T1_Add_Table( char_table, charcode,
-                                          cur + 1, len + 1 );
+                                               cur + 1, len + 1 );
             char_table->elements[charcode][len] = '\0';
             if ( parser->root.error )
               return;
@@ -1172,6 +1172,7 @@
     T1_ParserRec*  parser     = &loader->parser;
     PS_Table*      code_table = &loader->charstrings;
     PS_Table*      name_table = &loader->glyph_names;
+    PS_Table*      swap_table = &loader->swap_table;
     FT_Memory      memory     = parser->root.memory;
     FT_Error       error;
 
@@ -1192,7 +1193,9 @@
     if ( parser->root.error )
       return;
 
-    /* initialize tables, adding space for `swap' at table end   */
+    /* initialize tables (leaving room for addition of .notdef, */
+    /* if necessary).                                           */ 
+
     error = psaux->ps_table_funcs->init( code_table,
                                          loader->num_glyphs + 1,
                                          memory );
@@ -1205,6 +1208,15 @@
     if ( error )
       goto Fail;
 
+    /* Initialize table for swapping index notdef_index and */
+    /* index 0 names and codes (if necessary).              */
+
+    error = psaux->ps_table_funcs->init( swap_table, 4, memory );
+
+    if ( error )
+      goto Fail;
+
+
     n = 0;
     for (;;)
     {
@@ -1292,43 +1304,60 @@
          notdef_found                                      )
     {
 
-      /* Swap glyph in index 0 with /.notdef glyph.  First, add index 0     */
-      /* name/code to end of table. Then place notdef_index name/code into  */
-      /* index 0.  Then take end of table name/code and place it into index */
-      /* notdef_index.                                                      */
+      /* Swap glyph in index 0 with /.notdef glyph.  First, add index 0 name and   */
+      /* code entires to swap_table. Then place notdef_index name and code entires */
+      /* into swap_table.  Then swap name and code entries at indices notdef_index */
+      /* and 0 using values stored in swap_table.                                  */
 
-      error = T1_Add_Table( name_table, n,
+      /* Index 0 name */
+      error = T1_Add_Table( swap_table, 0,
                             name_table->elements[0],
                             name_table->lengths [0] );
       if ( error )
         goto Fail;
-      error = T1_Add_Table( code_table, n,
+
+      /* Index 0 code */
+      error = T1_Add_Table( swap_table, 1,
                             code_table->elements[0],
                             code_table->lengths [0] );
       if ( error )
         goto Fail;
 
-      error = T1_Add_Table( name_table, 0,
+      /* Index notdef_index name */
+      error = T1_Add_Table( swap_table, 2,
                             name_table->elements[notdef_index],
                             name_table->lengths [notdef_index] );
       if ( error )
         goto Fail;
 
-      error = T1_Add_Table( code_table, 0,
+      /* Index notdef_index code */
+      error = T1_Add_Table( swap_table, 3,
                             code_table->elements[notdef_index],
                             code_table->lengths [notdef_index] );
       if ( error )
         goto Fail;
 
       error = T1_Add_Table( name_table, notdef_index,
-                            name_table->elements[n],
-                            name_table->lengths [n] );
+                            swap_table->elements[0],
+                            swap_table->lengths [0] );
       if ( error )
         goto Fail;
 
       error = T1_Add_Table( code_table, notdef_index,
-                            code_table->elements[n],
-                            code_table->lengths [n] );
+                            swap_table->elements[1],
+                            swap_table->lengths [1] );
+      if ( error )
+        goto Fail;
+
+      error = T1_Add_Table( name_table, 0,
+                            swap_table->elements[2],
+                            swap_table->lengths [2] );
+      if ( error )
+        goto Fail;
+
+      error = T1_Add_Table( code_table, 0,
+                            swap_table->elements[3],
+                            swap_table->lengths [3] );
       if ( error )
         goto Fail;
 
@@ -1338,7 +1367,7 @@
 
       /* notdef_index is already 0, or /.notdef is undefined in  */
       /* charstrings dictionary. Worry about /.notdef undefined. */
-      /* we take index 0 and add it to the end of the table(s)   */
+      /* We take index 0 and add it to the end of the table(s)   */
       /* and add our own /.notdef glyph to index 0.              */
 
       /* 0 333 hsbw endchar                                      */
@@ -1346,13 +1375,13 @@
       char*    notdef_name    = (char *)".notdef";
 
 
-      error = T1_Add_Table( name_table, n,
+      error = T1_Add_Table( swap_table, 0,
                             name_table->elements[0],
                             name_table->lengths [0] );
       if ( error )
         goto Fail;
 
-      error = T1_Add_Table( code_table, n,
+      error = T1_Add_Table( swap_table, 1,
                             code_table->elements[0],
                             code_table->lengths [0] );
       if ( error )
@@ -1367,11 +1396,24 @@
       if ( error )
         goto Fail;
 
+      error = T1_Add_Table( name_table, n,
+                            swap_table->elements[0],
+                            swap_table->lengths [0] );
+      if ( error )
+        goto Fail;
+
+      error = T1_Add_Table( code_table, n,
+                            swap_table->elements[1],
+                            swap_table->lengths [1] );
+      if ( error )
+        goto Fail;
+
       /* we added a glyph. */
       loader->num_glyphs = n + 1;
 
     }
 
+
     return;
 
   Fail:
@@ -1537,6 +1579,7 @@
     loader->charstrings.init    = 0;
     loader->glyph_names.init    = 0;
     loader->subrs.init          = 0;
+    loader->swap_table.init     = 0;
     loader->fontdata            = 0;
   }
 
@@ -1551,6 +1594,7 @@
     T1_Release_Table( &loader->encoding_table );
     T1_Release_Table( &loader->charstrings );
     T1_Release_Table( &loader->glyph_names );
+    T1_Release_Table( &loader->swap_table );
     T1_Release_Table( &loader->subrs );
 
     /* finalize parser */