Commit cc712a248c2075b126429d677357bb3a732759a1
2007-04-27T17:16:50
* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative number of points in contours. Problem reported by Victor Stinner <victor.stinner@haypocalc.com>. (TT_Process_Simple_Glyph): Synchronize variable types.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49
diff --git a/ChangeLog b/ChangeLog
index 7769632..aedeb3a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2007-04-27 Werner Lemberg <wl@gnu.org>
+
+ * src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check for negative
+ number of points in contours. Problem reported by Victor Stinner
+ <victor.stinner@haypocalc.com>.
+ (TT_Process_Simple_Glyph): Synchronize variable types.
+
2007-04-26 Werner Lemberg <wl@gnu.org>
* src/base/ftglyph.c (FT_Glyph_Copy): Always set second argument to
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 4d7f61e..105518c 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -271,7 +271,11 @@
n_points = 0;
if ( n_contours > 0 )
+ {
n_points = cont[-1] + 1;
+ if ( n_points < 0 )
+ goto Invalid_Outline;
+ }
/* note that we will add four phantom points later */
error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 );
@@ -682,7 +686,7 @@
FT_GlyphLoader gloader = loader->gloader;
FT_Error error = TT_Err_Ok;
FT_Outline* outline;
- FT_UInt n_points;
+ FT_Int n_points;
outline = &gloader->current.outline;
@@ -709,7 +713,7 @@
/* Deltas apply to the unscaled data. */
FT_Vector* deltas;
FT_Memory memory = loader->face->memory;
- FT_UInt i;
+ FT_Int i;
error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face),