* src/sfnt/ttsbit.c (tt_face_load_sbit): Allow more version values. Some fonts seem to have the `version' field in the wrong byte order. Problem reported by 張俊芝 <418092625@qq.com>.
diff --git a/ChangeLog b/ChangeLog
index c126f7f..775201a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
2016-12-24 Werner Lemberg <wl@gnu.org>
+ * src/sfnt/ttsbit.c (tt_face_load_sbit): Allow more version values.
+
+ Some fonts seem to have the `version' field in the wrong byte order.
+
+ Problem reported by 張俊芝 <418092625@qq.com>.
+
+2016-12-24 Werner Lemberg <wl@gnu.org>
+
* src/truetype/ttpload.c (tt_face_load_loca): Sanitize table length.
This trivial fix allows us to accept more fonts.
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index bc51304..bf6ecca 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -107,8 +107,12 @@
version = FT_NEXT_LONG( p );
num_strikes = FT_NEXT_ULONG( p );
+ /* there's at least one font (FZShuSong-Z01, version 3) */
+ /* that uses the wrong byte order for the `version' field */
if ( ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00020000UL &&
- ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00030000UL )
+ ( (FT_ULong)version & 0x0000FFFFUL ) != 0x00000200UL &&
+ ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00030000UL &&
+ ( (FT_ULong)version & 0x0000FFFFUL ) != 0x00000300UL )
{
error = FT_THROW( Unknown_File_Format );
goto Exit;