* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative

ChangeLog

@@ -1,3 +1,10 @@
+2007-04-27  Werner Lemberg  <wl@gnu.org>
+
+	* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative
+	number of points in contours.  Problem reported by Victor Stinner
+	<victor.stinner@haypocalc.com>.
+	(TT_Process_Simple_Glyph): Synchronize variable types.
+
 2007-04-26  Werner Lemberg  <wl@gnu.org>
 
 	* src/base/ftglyph.c (FT_Glyph_Copy): Always set second argument to

src/truetype/ttgload.c

@@ -271,7 +271,11 @@
 
     n_points = 0;
     if ( n_contours > 0 )
+    {
       n_points = cont[-1] + 1;
+      if ( n_points < 0 )
+        goto Invalid_Outline;
+    }
 
     /* note that we will add four phantom points later */
     error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 );
@@ -682,7 +686,7 @@
     FT_GlyphLoader  gloader = loader->gloader;
     FT_Error        error   = TT_Err_Ok;
     FT_Outline*     outline;
-    FT_UInt         n_points;
+    FT_Int          n_points;
 
 
     outline  = &gloader->current.outline;
@@ -709,7 +713,7 @@
       /* Deltas apply to the unscaled data. */
       FT_Vector*  deltas;
       FT_Memory   memory = loader->face->memory;
-      FT_UInt     i;
+      FT_Int      i;
 
 
       error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),