From d9cdc15d80149e1524efca0a56e35ecb69ad90ce Mon Sep 17 00:00:00 2001
From: Parth Wazurkar <parthwazurkar@gmail.com>
Date: Thu, 12 Jul 2018 23:12:26 +0530
Subject: [PATCH] [gf] Minor Fixes.

---
 src/gf/gfdrivr.c |  6 +++---
 src/gf/gflib.c   | 22 +++++++++++++++++++---
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/src/gf/gfdrivr.c b/src/gf/gfdrivr.c
index df38e4b8f..3bc846122 100644
--- a/src/gf/gfdrivr.c
+++ b/src/gf/gfdrivr.c
@@ -238,14 +238,14 @@
 
     {
       FT_Bitmap_Size*  bsize = gfface->available_sizes;
-      FT_UShort        x_res, y_res;
+      /* FT_UShort        x_res, y_res; */
 
       bsize->height = (FT_Short) face->gf_glyph->font_bbx_h ;
       bsize->width  = (FT_Short) face->gf_glyph->font_bbx_w ;
       bsize->size   = (FT_Pos)   face->gf_glyph->ds << 6    ;
 
-      x_res = toint( go->hppp * 72.27 );
-      y_res = toint( go->vppp * 72.27 );
+      /* x_res = toint( go->hppp * 72.27 ); */
+      /* y_res = toint( go->vppp * 72.27 ); */
 
       bsize->y_ppem = (FT_Pos)(bsize->size/10) << 6 ;
       bsize->x_ppem = (FT_Pos)bsize->y_ppem ;
diff --git a/src/gf/gflib.c b/src/gf/gflib.c
index f7d48e1b3..ea2749575 100644
--- a/src/gf/gflib.c
+++ b/src/gf/gflib.c
@@ -404,11 +404,17 @@ unsigned char   bit_table[] = {
     min_n     = READ_INT4( stream );
     max_n     = READ_INT4( stream );
 
-    if( ptr_p < 0 )
+    if( ptr_p < 0 ) /* Defined to use ptr_p */
     {
       FT_ERROR(( "gf_load_font: invalid pointer in postamble\n" ));
       goto Exit;
     }
+
+    if( check_sum < 0 ) /* Defined to use check_sum */
+    {
+      FT_ERROR(( "gf_load_font: invalid check sum value\n" ));
+      goto Exit;
+    }
     #if 0
     gptr = ftell(fp);
     #endif
@@ -504,6 +510,11 @@ unsigned char   bit_table[] = {
         goto Exit;
       }
 
+      if( w > max_m)
+      {
+        FT_ERROR(( "gf_load_font: invalid width in charloc\n" ));
+        goto Exit;
+      }
       /* optr = ft_ftell(fp); */
       optr = stream->pos;
       /* ft_fseek(fp, ptr, SEEK_SET); */
@@ -521,11 +532,16 @@ unsigned char   bit_table[] = {
         goto Exit;
     }
     *goptr          = go;
-  return error;
+    return error;
 
-		Exit:
+    Exit:
       if (go != NULL)
       {
+        if( go->bm_table )
+        {
+          for (i = 0; i < nchars; i++)
+	          FT_FREE(go->bm_table[i].bitmap);
+        }
         FT_FREE(go->bm_table);
         FT_FREE(go);
       }