Make sure that parse_t2_real correctly parses a CFF real number. Added more comments to the function.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
diff --git a/src/cff/t2parse.c b/src/cff/t2parse.c
index 3df1f5c..6d1d744 100644
--- a/src/cff/t2parse.c
+++ b/src/cff/t2parse.c
@@ -153,7 +153,7 @@
FT_Byte* limit,
FT_Int power_ten )
{
- FT_Byte* p = ++start;
+ FT_Byte* p = start;
FT_Long num, divider, result, exp;
FT_Int sign = 0, exp_sign = 0;
FT_Byte nib;
@@ -166,14 +166,20 @@
/* first of all, read the integer part */
phase = 4;
- p--;
for (;;)
{
- /* read one nibble at a time */
- if ( phase && ++p >= limit )
+
+ /* If we entered this iteration with phase == 4, we need to */
+ /* read a new byte. This also skips past the intial 0x1E. */
+ if ( phase )
+ p++;
+
+ /* Make sure we don't read past the end. */
+ if ( p >= limit )
goto Bad;
+ /* Get the nibble. */
nib = ( p[0] >> phase ) & 0xF;
phase = 4 - phase;
@@ -189,13 +195,19 @@
if ( nib == 0xa )
for (;;)
{
- /* read one nibble at a time */
- if ( !phase && ++p >= limit )
+
+ /* If we entered this iteration with phase == 4, we need */
+ /* to read a new byte. */
+ if ( phase )
+ p++;
+
+ /* Make sure we don't read past the end. */
+ if ( p >= limit )
goto Bad;
- phase = 4 - phase;
+ /* Get the nibble. */
nib = ( p[0] >> phase ) & 0xF;
-
+ phase = 4 - phase;
if ( nib >= 10 )
break;
@@ -219,13 +231,18 @@
for (;;)
{
- /* read one nibble at a time */
- if ( !phase && ++p >= limit )
+ /* If we entered this iteration with phase == 4, we need */
+ /* to read a new byte. */
+ if ( phase )
+ p++;
+
+ /* Make sure we don't read past the end. */
+ if ( p >= limit )
goto Bad;
- phase = 4 - phase;
+ /* Get the nibble. */
nib = ( p[0] >> phase ) & 0xF;
-
+ phase = 4 - phase;
if ( nib >= 10 )
break;