Commit 6c05475d501663b77d8e4ccc00e792322c082ad8
2007-06-05T05:27:54
* src/pfr/pfrgload.c (pfr_glyph_done): Comment out unused code. (pfr_glyph_load_simple): Convert assertion into normal FreeType error. Check `idx'. (pfr_glyph_load_compound): Convert assertion into normal FreeType error. * src/pfr/pfrtypes.h (PFR_GlyphRec): Comment out unused code.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141
diff --git a/ChangeLog b/ChangeLog
index e61a8b5..dc28864 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2007-06-05 Werner Lemberg <wl@gnu.org>
+
+ * src/pfr/pfrgload.c (pfr_glyph_done): Comment out unused code.
+ (pfr_glyph_load_simple): Convert assertion into normal FreeType
+ error.
+ Check `idx'.
+ (pfr_glyph_load_compound): Convert assertion into normal FreeType
+ error.
+
+ * src/pfr/pfrtypes.h (PFR_GlyphRec): Comment out unused code.
+
2007-06-04 Werner Lemberg <wl@gnu.org>
* src/cid/cidgload.c (cid_load_glyph): Check `fd_select'.
diff --git a/src/pfr/pfrgload.c b/src/pfr/pfrgload.c
index 7cee187..6cf1eb8 100644
--- a/src/pfr/pfrgload.c
+++ b/src/pfr/pfrgload.c
@@ -4,7 +4,7 @@
/* */
/* FreeType PFR glyph loader (body). */
/* */
-/* Copyright 2002, 2003, 2005 by */
+/* Copyright 2002, 2003, 2005, 2007 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -59,8 +59,10 @@
glyph->y_control = NULL;
glyph->max_xy_control = 0;
+#if 0
glyph->num_x_control = 0;
glyph->num_y_control = 0;
+#endif
FT_FREE( glyph->subs );
@@ -244,7 +246,8 @@
flags = PFR_NEXT_BYTE( p );
/* test for composite glyphs */
- FT_ASSERT( ( flags & PFR_GLYPH_IS_COMPOUND ) == 0 );
+ if ( flags & PFR_GLYPH_IS_COMPOUND )
+ goto Failure;
x_count = 0;
y_count = 0;
@@ -410,7 +413,8 @@
cur = pos;
for ( n = 0; n < args_count; n++ )
{
- FT_Int idx, delta;
+ FT_UInt idx;
+ FT_Int delta;
/* read the X argument */
@@ -419,6 +423,8 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
+ if ( idx > x_count )
+ goto Failure;
cur->x = glyph->x_control[idx];
FT_TRACE7(( " cx#%d", idx ));
break;
@@ -447,6 +453,8 @@
case 0: /* 8-bit index */
PFR_CHECK( 1 );
idx = PFR_NEXT_BYTE( p );
+ if ( idx > y_count )
+ goto Failure;
cur->y = glyph->y_control[idx];
FT_TRACE7(( " cy#%d", idx ));
break;
@@ -519,6 +527,7 @@
Exit:
return error;
+ Failure:
Too_Short:
error = PFR_Err_Invalid_Table;
FT_ERROR(( "pfr_glyph_load_simple: invalid glyph data\n" ));
@@ -544,7 +553,8 @@
flags = PFR_NEXT_BYTE( p );
/* test for composite glyphs */
- FT_ASSERT( ( flags & PFR_GLYPH_IS_COMPOUND ) != 0 );
+ if ( !( flags & PFR_GLYPH_IS_COMPOUND ) )
+ goto Failure;
count = flags & 0x3F;
@@ -670,6 +680,7 @@
Exit:
return error;
+ Failure:
Too_Short:
error = PFR_Err_Invalid_Table;
FT_ERROR(( "pfr_glyph_load_compound: invalid glyph data\n" ));
@@ -677,9 +688,6 @@
}
-
-
-
static FT_Error
pfr_glyph_load_rec( PFR_Glyph glyph,
FT_Stream stream,
diff --git a/src/pfr/pfrtypes.h b/src/pfr/pfrtypes.h
index df12ecf..c0ae042 100644
--- a/src/pfr/pfrtypes.h
+++ b/src/pfr/pfrtypes.h
@@ -4,7 +4,7 @@
/* */
/* FreeType PFR data structures (specification only). */
/* */
-/* Copyright 2002, 2003, 2005 by */
+/* Copyright 2002, 2003, 2005, 2007 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -335,8 +335,10 @@ FT_BEGIN_HEADER
{
FT_Byte format;
+#if 0
FT_UInt num_x_control;
FT_UInt num_y_control;
+#endif
FT_UInt max_xy_control;
FT_Pos* x_control;
FT_Pos* y_control;