Index: src/truetype/ttgload.c |
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c |
index f35521e17b5f763b60de968211e74bad99359964..ce8c8887b9f53f2bb4e73ed439ba7669027d43a0 100644 |
--- a/src/truetype/ttgload.c |
+++ b/src/truetype/ttgload.c |
@@ -4,7 +4,7 @@ |
/* */ |
/* TrueType Glyph Loader (body). */ |
/* */ |
-/* Copyright 1996-2011 */ |
+/* Copyright 1996-2012 */ |
/* David Turner, Robert Wilhelm, and Werner Lemberg. */ |
/* */ |
/* This file is part of the FreeType project, and may only be used, */ |
@@ -362,19 +362,21 @@ |
if ( n_contours >= 0xFFF || p + ( n_contours + 1 ) * 2 > limit ) |
goto Invalid_Outline; |
- prev_cont = FT_NEXT_USHORT( p ); |
+ prev_cont = FT_NEXT_SHORT( p ); |
if ( n_contours > 0 ) |
cont[0] = prev_cont; |
+ if ( prev_cont < 0 ) |
+ goto Invalid_Outline; |
+ |
for ( cont++; cont < cont_limit; cont++ ) |
{ |
- cont[0] = FT_NEXT_USHORT( p ); |
+ cont[0] = FT_NEXT_SHORT( p ); |
if ( cont[0] <= prev_cont ) |
{ |
/* unordered contours: this is invalid */ |
- error = TT_Err_Invalid_Table; |
- goto Fail; |
+ goto Invalid_Outline; |
} |
prev_cont = cont[0]; |
} |
@@ -392,13 +394,6 @@ |
if ( error ) |
goto Fail; |
- /* we'd better check the contours table right now */ |
- outline = &gloader->current.outline; |
- |
- for ( cont = outline->contours + 1; cont < cont_limit; cont++ ) |
- if ( cont[-1] >= cont[0] ) |
- goto Invalid_Outline; |
- |
/* reading the bytecode instructions */ |
load->glyph->control_len = 0; |
load->glyph->control_data = 0; |
@@ -439,6 +434,8 @@ |
p += n_ins; |
+ outline = &gloader->current.outline; |
+ |
/* reading the point tags */ |
flag = (FT_Byte*)outline->tags; |
flag_limit = flag + n_points; |