Commit 42f5c714c055d9d8cade2ede35c3abb5ae448a2c
2009-03-03T23:34:49
Formatting.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92
diff --git a/ChangeLog b/ChangeLog
index 95833b9..c4a8e0c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,12 @@
2009-03-03 David Turner <david@freetype.org>
- Fix SFNT kerning table parser against malformed tables.
- Closes Savannah BUG #25750
+ Protect SFNT kerning table parser against malformed tables.
- * src/sfnt/ttkern.c (tt_face_get_kerning): fix a bug
- where a malformed table would be succesfully loaded but
- later crash the engine during parsing.
+ This closes Savannah BUG #25750.
+
+ * src/sfnt/ttkern.c (tt_face_load_kern, tt_face_get_kerning): Fix a
+ bug where a malformed table would be successfully loaded but later
+ crash the engine during parsing.
2009-03-03 David Turner <david@freetype.org>
diff --git a/docs/CHANGES b/docs/CHANGES
index 83e57c7..0e06b70 100644
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -33,8 +33,8 @@ CHANGES BETWEEN 2.3.9 and 2.3.8
- `FT_Get_Advance' (and `FT_Get_Advances') returned bad values for
almost all font formats except TrueType fonts.
- - Fix a bug in the SFNT kerning table loader/parser which could crash
- the engine if certain malformed tables were encountered.
+ - Fix a bug in the SFNT kerning table loader/parser which could
+ crash the engine if certain malformed tables were encountered.
II. IMPORTANT CHANGES
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index 52f9574..67d5115 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -5,7 +5,7 @@
/* Load the basic TrueType kerning table. This doesn't handle */
/* kerning data within the GPOS table at the moment. */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007 by */
+/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -103,8 +103,8 @@
p_next += length;
- if (p_next > p_limit) /* handle broken table */
- p_next = p_limit;
+ if ( p_next > p_limit ) /* handle broken table */
+ p_next = p_limit;
/* only use horizontal kerning tables */
if ( ( coverage & ~8 ) != 0x0001 ||
@@ -114,8 +114,8 @@
num_pairs = FT_NEXT_USHORT( p );
p += 6;
- if ( (p_next - p)/6 < (int)num_pairs ) /* handle broken count */
- num_pairs = (FT_UInt)((p_next - p)/6);
+ if ( ( p_next - p ) / 6 < (int)num_pairs ) /* handle broken count */
+ num_pairs = (FT_UInt)( ( p_next - p ) / 6 );
avail |= mask;
@@ -207,7 +207,7 @@
next = base + length;
- if (next > p_limit) /* handle broken table */
+ if ( next > p_limit ) /* handle broken table */
next = p_limit;
if ( ( face->kern_avail_bits & mask ) == 0 )
@@ -219,8 +219,8 @@
num_pairs = FT_NEXT_USHORT( p );
p += 6;
- if ((next - p)/6 < (int)num_pairs) /* handle broken count */
- num_pairs = (FT_UInt)((next - p)/6);
+ if ( ( next - p ) / 6 < (int)num_pairs ) /* handle broken count */
+ num_pairs = (FT_UInt)( ( next - p ) / 6 );
switch ( coverage >> 8 )
{