| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576 |
- --- freetype-2.3.11/src/cid/cidload.c 2009-07-03 15:28:24.000000000 +0200
- +++ freetype-2.3.11/src/cid/cidload.c 2011-11-15 12:58:41.000000000 +0100
- @@ -4,7 +4,7 @@
- /* */
- /* CID-keyed Type1 font loader (body). */
- /* */
- -/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2009 by */
- +/* Copyright 1996-2006, 2009, 2011 by */
- /* David Turner, Robert Wilhelm, and Werner Lemberg. */
- /* */
- /* This file is part of the FreeType project, and may only be used, */
- @@ -110,7 +110,7 @@
- CID_FaceDict dict;
-
-
- - if ( parser->num_dict < 0 )
- + if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
- {
- FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
- keyword->ident ));
- @@ -158,7 +158,7 @@
- FT_Fixed temp_scale;
-
-
- - if ( parser->num_dict >= 0 )
- + if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
- {
- dict = face->cid.font_dicts + parser->num_dict;
- matrix = &dict->font_matrix;
- @@ -249,7 +249,7 @@
- CID_FaceDict dict;
-
-
- - if ( parser->num_dict >= 0 )
- + if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
- {
- dict = face->cid.font_dicts + parser->num_dict;
-
- @@ -413,12 +413,25 @@
- FT_Byte* p;
-
-
- + /* Check for possible overflow. */
- + if ( num_subrs == FT_UINT_MAX )
- + {
- + error = CID_Err_Syntax_Error;
- + goto Fail;
- + }
- +
- /* reallocate offsets array if needed */
- if ( num_subrs + 1 > max_offsets )
- {
- FT_UInt new_max = FT_PAD_CEIL( num_subrs + 1, 4 );
-
-
- + if ( new_max <= max_offsets )
- + {
- + error = CID_Err_Syntax_Error;
- + goto Fail;
- + }
- +
- if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
- goto Fail;
-
- @@ -436,6 +449,11 @@
-
- FT_FRAME_EXIT();
-
- + /* offsets must be ordered */
- + for ( count = 1; count <= num_subrs; count++ )
- + if ( offsets[count - 1] > offsets[count] )
- + goto Fail;
- +
- /* now, compute the size of subrs charstrings, */
- /* allocate, and read them */
- data_len = offsets[num_subrs] - offsets[0];
|
