Commit abc44f5ecff10cbbaa89bf873eea3ecfd1e88ee2

Werner Lemberg 2007-08-18T06:38:07

* src/otvalid/otvcmmn.c (otv_x_y_ux_sy): Skip context glyphs. Found by Imran Yousaf. Fixes Savannah bug #20773. (otv_Lookup_validate): Correct handling of LookupType. Found by Imran Yousaf. Fixes Savannah bug #20782.

diff --git a/ChangeLog b/ChangeLog
index 328a7be..8b8eae9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2007-08-18  Werner Lemberg  <wl@gnu.org>
+
+	* src/otvalid/otvcmmn.c (otv_x_y_ux_sy): Skip context glyphs.  Found
+	by Imran Yousaf.  Fixes Savannah bug #20773.
+
+	(otv_Lookup_validate): Correct handling of LookupType.  Found by
+	Imran Yousaf.  Fixes Savannah bug #20782.
+
 2007-08-17  George Williams  <gww@silcom.com>
 
 	* src/otvalid/otvgsub.c (otv_SingleSubst_validate): Fix handling of
diff --git a/src/otvalid/otvcommn.c b/src/otvalid/otvcommn.c
index 6ed84e3..a4f885b 100644
--- a/src/otvalid/otvcommn.c
+++ b/src/otvalid/otvcommn.c
@@ -360,7 +360,7 @@
 
     OTV_TRACE(( " (type %d)\n", LookupType ));
 
-    if ( LookupType == 0 || LookupType >= valid->type_count )
+    if ( LookupType == 0 || LookupType > valid->type_count )
       FT_INVALID_DATA;
 
     validate = valid->type_funcs[LookupType - 1];
@@ -759,6 +759,7 @@
       FT_INVALID_DATA;
 
     OTV_LIMIT_CHECK( ( Count1 - 1 ) * 2 + Count2 * 4 );
+    p += ( Count1 - 1 ) * 2;
 
     for ( ; Count2 > 0; Count2-- )
     {