[truetype] Sanitizer fix. * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Increase array to fix nested loops.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
diff --git a/ChangeLog b/ChangeLog
index fc1ae90..ba6c185 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2016-07-19 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Sanitizer fix.
+
+ * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Increase array
+ to fix nested loops.
+
2016-07-18 Werner Lemberg <wl@gnu.org>
[truetype] Make GETDATA work only for GX fonts.
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 7c85d62..3715796 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -158,13 +158,16 @@
return NULL;
}
- if ( FT_NEW_ARRAY( points, n ) )
+ /* in the nested loops below we increase `i' twice; */
+ /* it is faster to simply allocate one more slot */
+ /* than to add another test within the loop */
+ if ( FT_NEW_ARRAY( points, n + 1 ) )
return NULL;
*point_cnt = n;
first = 0;
- i = 0;
+ i = 0;
while ( i < n )
{
runcnt = FT_GET_BYTE();