Commit da38be831d2c8ea5443c73d01ecfbc750bba7045

Werner Lemberg 2017-03-30T13:24:03

[truetype] Fix HVAR and VVAR handling (#50678). * src/truetype/ttgxvar.c (tt_hvadvance_adjust): Handle glyph indices larger than `mapCount' as described in the specification.

diff --git a/ChangeLog b/ChangeLog
index 65c492e..c741371 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2017-03-30  Werner Lemberg  <wl@gnu.org>
 
+	[truetype] Fix HVAR and VVAR handling (#50678).
+
+	* src/truetype/ttgxvar.c (tt_hvadvance_adjust): Handle
+	glyph indices larger than `mapCount' as described in the
+	specification.
+
+2017-03-30  Werner Lemberg  <wl@gnu.org>
+
 	[truetype] Allow linear scaling for unhinted rendering (#50470).
 
 	* src/truetype/ttdriver.c (tt_size_request): Revert change from
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index a87913d..6d4529b 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -1007,16 +1007,15 @@
 
     if ( table->widthMap.innerIndex )
     {
-      if ( gindex >= table->widthMap.mapCount )
-      {
-        FT_TRACE2(( "gindex %d out of range\n", gindex ));
-        error = FT_THROW( Invalid_Argument );
-        goto Exit;
-      }
+      FT_UInt  idx = gindex;
+
+
+      if ( idx >= table->widthMap.mapCount )
+        idx = table->widthMap.mapCount - 1;
 
       /* trust that HVAR parser has checked indices */
-      outerIndex = table->widthMap.outerIndex[gindex];
-      innerIndex = table->widthMap.innerIndex[gindex];
+      outerIndex = table->widthMap.outerIndex[idx];
+      innerIndex = table->widthMap.innerIndex[idx];
     }
     else
     {