Commit 1c70fcbc0aab13aed5bfe757553d0bbe6ab9461c
2010-06-27T00:43:23
Fix PFR change 2010-06-24. * src/pfr/pfrgload.c (pfr_glyph_load_simple): Really protect against invalid indices.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
diff --git a/ChangeLog b/ChangeLog
index 5988dcb..c01ecb8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2010-06-26 Werner Lemberg <wl@gnu.org>
+ Fix PFR change 2010-06-24.
+
+ * src/pfr/pfrgload.c (pfr_glyph_load_simple): Really protect against
+ invalid indices.
+
+2010-06-26 Werner Lemberg <wl@gnu.org>
+
Improve PFR tracing messages.
* src/pfr/pfrgload.c (pfr_glyph_load_rec): Emit tracing messages for
diff --git a/src/pfr/pfrgload.c b/src/pfr/pfrgload.c
index 2dd6a91..6f65b01 100644
--- a/src/pfr/pfrgload.c
+++ b/src/pfr/pfrgload.c
@@ -268,8 +268,8 @@
{
PFR_CHECK( 1 );
count = PFR_NEXT_BYTE( p );
- x_count = ( count & 15 );
- y_count = ( count >> 4 );
+ x_count = count & 15;
+ y_count = count >> 4;
}
else
{
@@ -388,7 +388,7 @@
case 2: /* horizontal line to */
FT_TRACE6(( "- horizontal line to cx.%d", format_low ));
- if ( format_low > x_count || x_count == 0 )
+ if ( format_low >= x_count )
goto Failure;
pos[0].x = glyph->x_control[format_low];
pos[0].y = pos[3].y;
@@ -398,7 +398,7 @@
case 3: /* vertical line to */
FT_TRACE6(( "- vertical line to cy.%d", format_low ));
- if ( format_low > y_count || y_count == 0 )
+ if ( format_low >= y_count )
goto Failure;
pos[0].x = pos[3].x;
pos[0].y = glyph->y_control[format_low];
@@ -440,7 +440,7 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
- if ( idx > x_count || x_count == 0 )
+ if ( idx >= x_count )
goto Failure;
cur->x = glyph->x_control[idx];
FT_TRACE7(( " cx#%d", idx ));
@@ -470,7 +470,7 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
- if ( idx > y_count || y_count == 0 )
+ if ( idx >= y_count )
goto Failure;
cur->y = glyph->y_control[idx];
FT_TRACE7(( " cy#%d", idx ));