diff options
| author | Werner Lemberg <wl@gnu.org> | 2015-10-26 15:40:22 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2015-10-26 15:40:22 +0100 |
| commit | 6a19a7d332c5446542196e5aeda0ede109ef097b (patch) | |
| tree | f5d44903c88152678ca4fce35b147b3cd9ef595c /src/truetype/ttpload.c | |
| parent | 7f00fa64627bb57042ec62aa2ec938f679e097c1 (diff) | |
| download | freetype2-6a19a7d332c5446542196e5aeda0ede109ef097b.tar.gz | |
[truetype] Fix sanitizing logic for `loca' (#46223).
* src/truetype/ttpload.c (tt_face_load_loca): A thinko caused an
incorrect adjustment of the number of glyphs, most often using far
too large values.
Diffstat (limited to 'src/truetype/ttpload.c')
| -rw-r--r-- | src/truetype/ttpload.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c index 814c90c3d..9bf67f963 100644 --- a/src/truetype/ttpload.c +++ b/src/truetype/ttpload.c @@ -124,8 +124,9 @@ TT_Table entry = face->dir_tables; TT_Table limit = entry + face->num_tables; - FT_Long pos = (FT_Long)FT_STREAM_POS(); - FT_Long dist = 0x7FFFFFFFL; + FT_Long pos = (FT_Long)FT_STREAM_POS(); + FT_Long dist = 0x7FFFFFFFL; + FT_Bool found = 0; /* compute the distance to next table in font file */ @@ -135,10 +136,13 @@ if ( diff > 0 && diff < dist ) - dist = diff; + { + dist = diff; + found = 1; + } } - if ( entry == limit ) + if ( !found ) { /* `loca' is the last table */ dist = (FT_Long)stream->size - pos; |