From cc712a248c2075b126429d677357bb3a732759a1 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Fri, 27 Apr 2007 17:16:50 +0000 Subject: [PATCH] * src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative number of points in contours. Problem reported by Victor Stinner . (TT_Process_Simple_Glyph): Synchronize variable types. --- ChangeLog | 7 +++++++ src/truetype/ttgload.c | 8 ++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 77696326a..aedeb3a60 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2007-04-27 Werner Lemberg + + * src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative + number of points in contours. Problem reported by Victor Stinner + . + (TT_Process_Simple_Glyph): Synchronize variable types. + 2007-04-26 Werner Lemberg * src/base/ftglyph.c (FT_Glyph_Copy): Always set second argument to diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c index 4d7f61eae..105518cc4 100644 --- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -271,7 +271,11 @@ n_points = 0; if ( n_contours > 0 ) + { n_points = cont[-1] + 1; + if ( n_points < 0 ) + goto Invalid_Outline; + } /* note that we will add four phantom points later */ error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 ); @@ -682,7 +686,7 @@ FT_GlyphLoader gloader = loader->gloader; FT_Error error = TT_Err_Ok; FT_Outline* outline; - FT_UInt n_points; + FT_Int n_points; outline = &gloader->current.outline; @@ -709,7 +713,7 @@ /* Deltas apply to the unscaled data. */ FT_Vector* deltas; FT_Memory memory = loader->face->memory; - FT_UInt i; + FT_Int i; error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),