--- freetype-2.1.1/src/sfnt/ttcmap0-orig.c Tue Jun 11 08:03:35 2002 +++ freetype-2.1.1/src/sfnt/ttcmap0.c Wed Jun 12 13:04:33 2002 @@ -685,9 +685,18 @@ p += offset; /* start of glyph id array */ /* check that we point within the glyph ids table only */ - if ( p < glyph_ids || - p + ( end - start + 1 ) * 2 > table + length ) - FT_INVALID_DATA; + if ( valid->level >= FT_VALIDATE_TIGHT ) + { + if ( p < glyph_ids || + p + ( end - start + 1 ) * 2 > table + length ) + FT_INVALID_DATA; + } + else + { + if ( p < glyph_ids || + p + ( end - start + 1 ) * 2 > valid->limit ) + FT_INVALID_DATA; + } /* check glyph indices within the segment range */ if ( valid->level >= FT_VALIDATE_TIGHT )