In cid_load_glyph, decrypt charstrings only if lenIV >= 0.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46
diff --git a/src/cid/cidgload.c b/src/cid/cidgload.c
index 44ffa3b..2900044 100644
--- a/src/cid/cidgload.c
+++ b/src/cid/cidgload.c
@@ -69,7 +69,6 @@
CID_FontDict* dict;
CID_Subrs* cid_subrs = face->subrs + fd_select;
FT_Byte* charstring;
- FT_UInt lenIV;
FT_Memory memory = face->root.memory;
@@ -80,10 +79,10 @@
/* setup font matrix */
dict = cid->font_dicts + fd_select;
- lenIV = dict->private_dict.lenIV;
decoder->font_matrix = dict->font_matrix;
decoder->font_offset = dict->font_offset;
+ decoder->lenIV = dict->private_dict.lenIV;
/* the charstrings are encoded (stupid!) */
/* load the charstrings, then execute it */
@@ -93,10 +92,18 @@
if ( !FILE_Read_At( cid->data_offset + off1, charstring, glyph_len ) )
{
- cid_decrypt( charstring, glyph_len, 4330 );
+ FT_Int cs_offset;
+
+ /* Adjustment for seed bytes. */
+ cs_offset = ( decoder->lenIV >= 0 ? decoder->lenIV : 0 );
+
+ /* Decrypt only if lenIV >= 0. */
+ if ( decoder->lenIV >= 0 )
+ cid_decrypt( charstring, glyph_len, 4330 );
+
error = decoder->funcs.parse_charstrings( decoder,
- charstring + lenIV,
- glyph_len - lenIV );
+ charstring + cs_offset,
+ glyph_len - cs_offset );
}
FREE( charstring );