Annotation of /trunk/freetype/patches/freetype-2.3.2-ttgload.patch
Parent Directory | Revision Log
Revision 210 -
(hide annotations)
(download)
Thu May 24 09:45:22 2007 UTC (17 years, 4 months ago) by niro
File size: 1063 byte(s)
Thu May 24 09:45:22 2007 UTC (17 years, 4 months ago) by niro
File size: 1063 byte(s)
-security fix
1 | niro | 210 | diff -Naur freetype-2.3.2/src/truetype/ttgload.c freetype-2.3.2-m32/src/truetype/ttgload.c |
2 | --- freetype-2.3.2/src/truetype/ttgload.c 2007-02-01 08:36:16.000000000 +0100 | ||
3 | +++ freetype-2.3.2-m32/src/truetype/ttgload.c 2007-05-22 21:49:12.000000000 +0200 | ||
4 | @@ -271,7 +271,11 @@ | ||
5 | |||
6 | n_points = 0; | ||
7 | if ( n_contours > 0 ) | ||
8 | + { | ||
9 | n_points = cont[-1] + 1; | ||
10 | + if ( n_points < 0 ) | ||
11 | + goto Invalid_Outline; | ||
12 | + } | ||
13 | |||
14 | /* note that we will add four phantom points later */ | ||
15 | error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 ); | ||
16 | @@ -682,7 +686,7 @@ | ||
17 | FT_GlyphLoader gloader = loader->gloader; | ||
18 | FT_Error error = TT_Err_Ok; | ||
19 | FT_Outline* outline; | ||
20 | - FT_UInt n_points; | ||
21 | + FT_Int n_points; | ||
22 | |||
23 | |||
24 | outline = &gloader->current.outline; | ||
25 | @@ -709,7 +713,7 @@ | ||
26 | /* Deltas apply to the unscaled data. */ | ||
27 | FT_Vector* deltas; | ||
28 | FT_Memory memory = loader->face->memory; | ||
29 | - FT_UInt i; | ||
30 | + FT_Int i; | ||
31 | |||
32 | |||
33 | error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face), |