Commit 58cbc465d2ccd904dee755cff791fbb3a866646d
2012-02-26T05:26:56
[type1] Fix Savannah bug #35606. * src/type1/t1load.c (parse_subrs): Add proper guards for `strncmp'. * src/psaux/psobjs.c (ps_parser_skip_PS_token): Emit error message only if cur < limit.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
diff --git a/ChangeLog b/ChangeLog
index 9a98b10..044c3b0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2012-02-26 Werner Lemberg <wl@gnu.org>
+
+ [type1] Fix Savannah bug #35606.
+
+ * src/type1/t1load.c (parse_subrs): Add proper guards for `strncmp'.
+
+ * src/psaux/psobjs.c (ps_parser_skip_PS_token): Emit error message
+ only if cur < limit.
+
2012-02-25 Werner Lemberg <wl@gnu.org>
[pcf] Fix Savannah bug #35603.
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
index a28b5fc..06df6e6 100644
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -4,7 +4,7 @@
/* */
/* Auxiliary functions for PostScript fonts (body). */
/* */
-/* Copyright 1996-2011 by */
+/* Copyright 1996-2012 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -589,7 +589,7 @@
}
Exit:
- if ( cur == parser->cursor )
+ if ( cur < limit && cur == parser->cursor )
{
FT_ERROR(( "ps_parser_skip_PS_token:"
" current token is `%c' which is self-delimiting\n"
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 990f85f..a0adfd4 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1388,7 +1388,8 @@
/* If the next token isn't `dup' we are done. */
- if ( ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
+ if ( parser->root.cursor + 4 < parser->root.limit &&
+ ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
break;
T1_Skip_PS_Token( parser ); /* `dup' */
@@ -1407,7 +1408,8 @@
return;
T1_Skip_Spaces ( parser );
- if ( ft_strncmp( (char*)parser->root.cursor, "put", 3 ) == 0 )
+ if ( parser->root.cursor + 4 < parser->root.limit &&
+ ft_strncmp( (char*)parser->root.cursor, "put", 3 ) == 0 )
{
T1_Skip_PS_Token( parser ); /* skip `put' */
T1_Skip_Spaces ( parser );