type1: Check invalid string longer than PostScript limit.
diff --git a/ChangeLog b/ChangeLog
index a8beb71..33f4dc7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+ type1: Check invalid string longer than PostScript limit.
+
+ * src/type1/t1afm.c (t1_get_index): Check invalid string
+ which exceeds the limit of PostScript string/name objects.
+
+2009-07-31 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
gzip: Use FT2 zcalloc() & zfree() in ftgzip.c by default.
* src/gzip/ftgzip.c (zcalloc, zcfree): Disable all
diff --git a/src/type1/t1afm.c b/src/type1/t1afm.c
index 5aea588..586bfd6 100644
--- a/src/type1/t1afm.c
+++ b/src/type1/t1afm.c
@@ -57,6 +57,10 @@
FT_Int n;
+ /* PS string/name length must be < 16-bit */
+ if ( ( len - 0xFFFFU ) > 0 )
+ return 0;
+
for ( n = 0; n < type1->num_glyphs; n++ )
{
char* gname = (char*)type1->glyph_names[n];