[freetype2] master 8de39a7: [sfnt] Fix infinite loops with broken cmaps (#46167).

[Werner LEMBERG]

branch: master
commit 8de39a7919ad1bbd433dd62810c91272b7095455
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [sfnt] Fix infinite loops with broken cmaps (#46167).
    
    * src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next): Take care
    of border condidions (i.e., if the loops exit naturally).
---
 ChangeLog         |    7 +++++++
 src/sfnt/ttcmap.c |    6 ++++++
 2 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 9062221..a3c7ac1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2015-10-10  Werner Lemberg  <address@hidden>
 
+       [sfnt] Fix infinite loops with broken cmaps (#46167).
+
+       * src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next): Take care
+       of border condidions (i.e., if the loops exit naturally).
+
+2015-10-10  Werner Lemberg  <address@hidden>
+
        [truetype] More sanity tests for GX handling.
 
        These tests should mainly help avoid unnecessarily large memory
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index c4d9abd..f572508 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -1891,7 +1891,10 @@
         /* if `gindex' is invalid, the remaining values */
         /* in this group are invalid, too               */
         if ( gindex >= (FT_UInt)face->num_glyphs )
+        {
+          gindex = 0;
           continue;
+        }
 
         result = char_code;
         break;
@@ -2277,7 +2280,10 @@
         /* if `gindex' is invalid, the remaining values */
         /* in this group are invalid, too               */
         if ( gindex >= (FT_UInt)face->num_glyphs )
+        {
+          gindex = 0;
           continue;
+        }
 
         cmap->cur_charcode = char_code;
         cmap->cur_gindex   = gindex;