Contents of /trunk/freetype/patches/freetype-2.3.2-ttgload.patch
Parent Directory | Revision Log
Revision 210 -
(show annotations)
(download)
Thu May 24 09:45:22 2007 UTC (17 years, 4 months ago) by niro
File size: 1063 byte(s)
Thu May 24 09:45:22 2007 UTC (17 years, 4 months ago) by niro
File size: 1063 byte(s)
-security fix
1 | diff -Naur freetype-2.3.2/src/truetype/ttgload.c freetype-2.3.2-m32/src/truetype/ttgload.c |
2 | --- freetype-2.3.2/src/truetype/ttgload.c 2007-02-01 08:36:16.000000000 +0100 |
3 | +++ freetype-2.3.2-m32/src/truetype/ttgload.c 2007-05-22 21:49:12.000000000 +0200 |
4 | @@ -271,7 +271,11 @@ |
5 | |
6 | n_points = 0; |
7 | if ( n_contours > 0 ) |
8 | + { |
9 | n_points = cont[-1] + 1; |
10 | + if ( n_points < 0 ) |
11 | + goto Invalid_Outline; |
12 | + } |
13 | |
14 | /* note that we will add four phantom points later */ |
15 | error = FT_GLYPHLOADER_CHECK_POINTS( gloader, n_points + 4, 0 ); |
16 | @@ -682,7 +686,7 @@ |
17 | FT_GlyphLoader gloader = loader->gloader; |
18 | FT_Error error = TT_Err_Ok; |
19 | FT_Outline* outline; |
20 | - FT_UInt n_points; |
21 | + FT_Int n_points; |
22 | |
23 | |
24 | outline = &gloader->current.outline; |
25 | @@ -709,7 +713,7 @@ |
26 | /* Deltas apply to the unscaled data. */ |
27 | FT_Vector* deltas; |
28 | FT_Memory memory = loader->face->memory; |
29 | - FT_UInt i; |
30 | + FT_Int i; |
31 | |
32 | |
33 | error = TT_Vary_Get_Glyph_Deltas( (TT_Face)(loader->face), |