freetype-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ft-devel] details on iPhone exploit caused by FreeType?


From: Алексей Подтележников
Subject: Re: [ft-devel] details on iPhone exploit caused by FreeType?
Date: Sat, 9 Jul 2011 15:02:19 -0400

Moving error check down to default, where it belongs

diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c
index a60ec38..f015e47 100644
--- a/src/psaux/t1decode.c
+++ b/src/psaux/t1decode.c
@@ -686,9 +686,6 @@
         subr_no = (FT_Int)( top[1] >> 16 );
         arg_cnt = (FT_Int)( top[0] >> 16 );

-        if ( arg_cnt < 0 || subr_no < 0 )
-          goto Unexpected_OtherSubr;
-
         /***********************************************************/
         /*                                                         */
         /* remove all operands to callothersubr from the stack     */
@@ -1011,11 +1008,14 @@
           break;

         default:
-          FT_ERROR(( "t1_decoder_parse_charstrings:"
-                     " unknown othersubr [%d %d], wish me luck\n",
-                     arg_cnt, subr_no ));
-          unknown_othersubr_result_cnt = arg_cnt;
-          break;
+          if ( arg_cnt >= 0 && subr_no > 0 )
+          {
+            FT_ERROR(( "t1_decoder_parse_charstrings:"
+                       " unknown othersubr [%d %d], wish me luck\n",
+                       arg_cnt, subr_no ));
+            unknown_othersubr_result_cnt = arg_cnt;
+            break;
+          }

         Unexpected_OtherSubr:
           FT_ERROR(( "t1_decoder_parse_charstrings:"



reply via email to

[Prev in Thread] Current Thread [Next in Thread]