Commit 9b00875093d1d646798a59d8f5793575fee93adf

Werner Lemberg 2011-04-13T13:37:37

Fix Savannah bug #33047. Patch submitted by anonymous reporter. * src/psaux/psobjs.c (ps_table_add): Use FT_PtrDist for pointer difference.

diff --git a/ChangeLog b/ChangeLog
index 09be153..6dd597c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2011-04-13  Werner Lemberg  <wl@gnu.org>
+
+	Fix Savannah bug #33047.
+
+	Patch submitted by anonymous reporter.
+
+	* src/psaux/psobjs.c (ps_table_add): Use FT_PtrDist for pointer
+	difference.
+
 2011-04-11  Kan-Ru Chen  <kanru@kanru.info>
 
 	Fix reading of signed integers from files on 64bit platforms.
diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c
index 45c7419..a28b5fc 100644
--- a/src/psaux/psobjs.c
+++ b/src/psaux/psobjs.c
@@ -4,8 +4,7 @@
 /*                                                                         */
 /*    Auxiliary functions for PostScript fonts (body).                     */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
-/*            2010 by                                                      */
+/*  Copyright 1996-2011 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -186,13 +185,13 @@
     /* grow the base block if needed */
     if ( table->cursor + length > table->capacity )
     {
-      FT_Error   error;
-      FT_Offset  new_size = table->capacity;
-      FT_Long    in_offset;
+      FT_Error    error;
+      FT_Offset   new_size = table->capacity;
+      FT_PtrDist  in_offset;
 
 
-      in_offset = (FT_Long)((FT_Byte*)object - table->block);
-      if ( (FT_ULong)in_offset >= table->capacity )
+      in_offset = (FT_Byte*)object - table->block;
+      if ( in_offset < 0 || (FT_Offset)in_offset >= table->capacity )
         in_offset = -1;
 
       while ( new_size < table->cursor + length )