[truetype] Improve error handling of `SHZ' bytecode instruction. Problem reported by Chris Evans <scarybeasts@gmail.com>. * src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
diff --git a/ChangeLog b/ChangeLog
index afe662d..69e7304 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2010-10-06 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Improve error handling of `SHZ' bytecode instruction.
+ Problem reported by Chris Evans <scarybeasts@gmail.com>.
+
+ * src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
+
2010-10-05 Werner Lemberg <wl@gnu.org>
Fix Savannah bug #31253.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index bf9189c..e196dce 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -5795,7 +5795,16 @@
if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 )
last_point = (FT_UShort)( CUR.zp2.n_points - 1 );
else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
+ {
last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] );
+
+ if ( BOUNDS( last_point, CUR.zp2.n_points ) )
+ {
+ if ( CUR.pedantic_hinting )
+ CUR.error = TT_Err_Invalid_Reference;
+ return;
+ }
+ }
else
last_point = 0;