Commit 18b552f6aeb84dc6fb5f9b8a3b37e0d4414de45e
2010-06-27T15:41:02
[cff] Really fix `hintmask' and `cntrmask' limit check. * src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_hintmask>: Fix thinko and handle tracing also.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
diff --git a/ChangeLog b/ChangeLog
index c36a909..087ce1c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2010-06-27 Werner Lemberg <wl@gnu.org>
+ [cff] Really fix `hintmask' and `cntrmask' limit check.
+
+ * src/cff/cffgload.c (cff_decoder_parse_charstrings)
+ <cff_op_hintmask>: Fix thinko and handle tracing also.
+
+2010-06-27 Werner Lemberg <wl@gnu.org>
+
Fix valgrind warning.
* src/base/ftoutln.c (FT_Outline_Get_Orientation): Initialize
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index e77e280..5459e67 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -1339,16 +1339,16 @@
decoder->num_hints += num_args / 2;
}
- if ( hinter )
- {
- /* In a valid charstring there must be at least three bytes */
- /* after `hintmask' or `cntrmask' (two for a `moveto' */
- /* operator and one for `endchar'). Additionally, there */
- /* must be space for `num_hints' bits. */
+ /* In a valid charstring there must be at least three bytes */
+ /* after `hintmask' or `cntrmask' (two for a `moveto' */
+ /* operator and one for `endchar'). Additionally, there */
+ /* must be space for `num_hints' bits. */
- if ( ( ip + 3 + ( decoder->num_hints >> 8 ) ) >= limit )
- goto Syntax_Error;
+ if ( ( ip + 3 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
+ goto Syntax_Error;
+ if ( hinter )
+ {
if ( op == cff_op_hintmask )
hinter->hintmask( hinter->hints,
builder->current->n_points,
@@ -1377,8 +1377,6 @@
#else
ip += ( decoder->num_hints + 7 ) >> 3;
#endif
- if ( ip >= limit )
- goto Syntax_Error;
args = stack;
break;