[truetype] Fix `loca' handling for inconsistent number of glyphs.

Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>.

* src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
handle case where `loca' is the last table in the font.

ChangeLog

@@ -1,3 +1,11 @@
+2010-11-18  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Fix `loca' handling for inconsistent number of glyphs.
+	Reported by Johnson Y. Yan <yinsen_yan@foxitsoftware.com>.
+
+	* src/truetype/ttpload.c (tt_face_load_loca): While sanitizing,
+	handle case where `loca' is the last table in the font.
+
 2010-11-18  Werner Lemberg  <wl@gnu.org>
 
 	[sfnt] Ignore all errors while loading `OS/2' table.

src/truetype/ttpload.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType-specific tables loader (body).                              */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -137,6 +137,12 @@
             dist = diff;
         }
 
+        if ( entry == limit )
+        {
+          /* `loca' is the last table */
+          dist = stream->size - pos;
+        }
+
         if ( new_loca_len <= dist )
         {
           face->num_locations = face->root.num_glyphs;
@@ -307,7 +313,7 @@
       FT_Short*  limit = cur + face->cvt_size;
 
 
-      for ( ; cur <  limit; cur++ )
+      for ( ; cur < limit; cur++ )
         *cur = FT_GET_SHORT();
     }