[type1, type42] Fix Savannah bug #43655.

* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c (t42_parse_charstrings): Fix boundary testing.
10 years ago · dd89710f0f
parent b1fc00d5dc
commit dd89710f0f
3 changed files with 9 additions and 2 deletions
--- a/7
+++ b/7
@ -1,3 +1,10 @@
+2014-11-21  Werner Lemberg  <wl@gnu.org>
+
+	[type1, type42] Fix Savannah bug #43655.
+
+	* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c
+	(t42_parse_charstrings): Fix boundary testing.
+
 2014-11-21  Werner Lemberg  <wl@gnu.org>

 	* src/pcf/pcfread.c (pcf_get_metrics): Sanitize invalid metrics.
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@ -1604,7 +1604,7 @@
        FT_PtrDist  len;


-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
        {
          error = FT_THROW( Invalid_File_Format );
          goto Fail;
--- a/src/type42/t42parse.c
+++ b/src/type42/t42parse.c
@ -858,7 +858,7 @@
        FT_PtrDist  len;


-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
        {
          FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));
          error = FT_THROW( Invalid_File_Format );