[cff] Final try to fix `hintmask' and `cntrmask' limit check. Problem reported by Tobias Wolf <towolf@gmail.com>. * src/cff/cffgload.c (cff_decoder_parse_charstrings) <cff_op_hintmask>: Sigh. I'm apparently too silly to fix this correctly in less than three tries.
diff --git a/ChangeLog b/ChangeLog
index df818ee..334a23d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2010-07-17 Werner Lemberg <wl@gnu.org>
+
+ [cff] Final try to fix `hintmask' and `cntrmask' limit check.
+
+ Problem reported by Tobias Wolf <towolf@gmail.com>.
+
+ * src/cff/cffgload.c (cff_decoder_parse_charstrings)
+ <cff_op_hintmask>: Sigh. I'm apparently too silly to fix this
+ correctly in less than three tries.
+
2010-07-12 Werner Lemberg <wl@gnu.org>
* Version 2.4.0 released.
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 4a5f8f0..347041c 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -1344,7 +1344,7 @@
/* instruction). Additionally, there must be space for */
/* `num_hints' bits. */
- if ( ( ip + 1 + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
+ if ( ( ip + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
goto Syntax_Error;
if ( hinter )