| Index: src/truetype/ttgload.c
|
| diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
|
| index f35521e17b5f763b60de968211e74bad99359964..ce8c8887b9f53f2bb4e73ed439ba7669027d43a0 100644
|
| --- a/src/truetype/ttgload.c
|
| +++ b/src/truetype/ttgload.c
|
| @@ -4,7 +4,7 @@
|
| /* */
|
| /* TrueType Glyph Loader (body). */
|
| /* */
|
| -/* Copyright 1996-2011 */
|
| +/* Copyright 1996-2012 */
|
| /* David Turner, Robert Wilhelm, and Werner Lemberg. */
|
| /* */
|
| /* This file is part of the FreeType project, and may only be used, */
|
| @@ -362,19 +362,21 @@
|
| if ( n_contours >= 0xFFF || p + ( n_contours + 1 ) * 2 > limit )
|
| goto Invalid_Outline;
|
|
|
| - prev_cont = FT_NEXT_USHORT( p );
|
| + prev_cont = FT_NEXT_SHORT( p );
|
|
|
| if ( n_contours > 0 )
|
| cont[0] = prev_cont;
|
|
|
| + if ( prev_cont < 0 )
|
| + goto Invalid_Outline;
|
| +
|
| for ( cont++; cont < cont_limit; cont++ )
|
| {
|
| - cont[0] = FT_NEXT_USHORT( p );
|
| + cont[0] = FT_NEXT_SHORT( p );
|
| if ( cont[0] <= prev_cont )
|
| {
|
| /* unordered contours: this is invalid */
|
| - error = TT_Err_Invalid_Table;
|
| - goto Fail;
|
| + goto Invalid_Outline;
|
| }
|
| prev_cont = cont[0];
|
| }
|
| @@ -392,13 +394,6 @@
|
| if ( error )
|
| goto Fail;
|
|
|
| - /* we'd better check the contours table right now */
|
| - outline = &gloader->current.outline;
|
| -
|
| - for ( cont = outline->contours + 1; cont < cont_limit; cont++ )
|
| - if ( cont[-1] >= cont[0] )
|
| - goto Invalid_Outline;
|
| -
|
| /* reading the bytecode instructions */
|
| load->glyph->control_len = 0;
|
| load->glyph->control_data = 0;
|
| @@ -439,6 +434,8 @@
|
|
|
| p += n_ins;
|
|
|
| + outline = &gloader->current.outline;
|
| +
|
| /* reading the point tags */
|
| flag = (FT_Byte*)outline->tags;
|
| flag_limit = flag + n_points;
|
|
|