Commit ae6d1d7b98880e90af9452d25e9cbdd4f9d97966

suzuki toshiya 2011-02-20T19:13:25

[cache] Fix an off-by-one bug in FTC_Manager_RemoveFaceID(). Found by <ychen1392001@yahoo.com.cn>, see detail in http://lists.gnu.org/archive/html/freetype/2011-01/msg00023.html * src/cache/ftccache.c (FTC_Cache_RemoveFaceID): Check the node buckets[cache->p + cache->mask] too.

diff --git a/ChangeLog b/ChangeLog
index 67f8fd1..d04bda3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2011-02-20  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	[cache] Fix an off-by-one bug in FTC_Manager_RemoveFaceID().
+	Found by <ychen1392001@yahoo.com.cn>, see detail in
+
+	  http://lists.gnu.org/archive/html/freetype/2011-01/msg00023.html
+
+	* src/cache/ftccache.c (FTC_Cache_RemoveFaceID): Check the node
+	buckets[cache->p + cache->mask] too.
+
 2011-02-19  Kevin Kofler  <kevin.kofler@chello.at>
 
 	Fall back to autohinting if a TTF/OTF doesn't contain any bytecode.
diff --git a/src/cache/ftccache.c b/src/cache/ftccache.c
index 865fbb7..f01c403 100644
--- a/src/cache/ftccache.c
+++ b/src/cache/ftccache.c
@@ -574,7 +574,7 @@
     FTC_Node     frees   = NULL;
 
 
-    count = cache->p + cache->mask;
+    count = cache->p + cache->mask + 1;
     for ( i = 0; i < count; i++ )
     {
       FTC_Node*  bucket = cache->buckets + i;