123456789101112131415161718192021222324252627282930313233343536373839 |
- --- freetype-2.3.11/src/base/ftobjs.c 2009-09-02 08:42:41.000000000 +0200
- +++ freetype-2.3.11/src/base/ftobjs.c 2010-07-12 16:39:13.000000000 +0200
- @@ -1531,6 +1531,8 @@
- len += rlen;
- else
- {
- + if ( pfb_lenpos + 3 > pfb_len + 2 )
- + goto Exit2;
- pfb_data[pfb_lenpos ] = (FT_Byte)( len );
- pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );
- pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );
- @@ -1539,6 +1541,8 @@
- if ( ( flags >> 8 ) == 5 ) /* End of font mark */
- break;
-
- + if ( pfb_pos + 6 > pfb_len + 2 )
- + goto Exit2;
- pfb_data[pfb_pos++] = 0x80;
-
- type = flags >> 8;
- @@ -1553,12 +1557,18 @@
- }
-
- error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
- + if ( error )
- + goto Exit2;
- pfb_pos += rlen;
- }
-
- + if ( pfb_pos + 2 > pfb_len + 2 )
- + goto Exit2;
- pfb_data[pfb_pos++] = 0x80;
- pfb_data[pfb_pos++] = 3;
-
- + if ( pfb_lenpos + 3 > pfb_len + 2 )
- + goto Exit2;
- pfb_data[pfb_lenpos ] = (FT_Byte)( len );
- pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );
- pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );
|