[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master 60d13bd: [type1] Avoid shift of negative numbers (#46
From: |
Werner LEMBERG |
Subject: |
[freetype2] master 60d13bd: [type1] Avoid shift of negative numbers (#46732). |
Date: |
Mon, 21 Dec 2015 16:27:31 +0000 |
branch: master
commit 60d13bd432f56421ed63c5bf14a73e006e9bf7ad
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[type1] Avoid shift of negative numbers (#46732).
* src/type1/t1load.c (parse_subrs): Do it.
---
ChangeLog | 6 ++++++
src/type1/t1load.c | 3 ++-
2 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index fa32735..fee0e5a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2015-12-21 Werner Lemberg <address@hidden>
+
+ [type1] Avoid shift of negative numbers (#46732).
+
+ * src/type1/t1load.c (parse_subrs): Do it.
+
2015-12-20 Werner Lemberg <address@hidden>
[type1, psaux] Handle large values of num_subrs correctly (#46692).
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 3fb3cd2..4cb6ef0 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1433,7 +1433,8 @@
}
/* we certainly need more than 8 bytes per subroutine */
- if ( num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
+ if ( parser->root.limit > parser->root.cursor &&
+ num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
{
/*
* There are two possibilities. Either the font contains an invalid
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master 60d13bd: [type1] Avoid shift of negative numbers (#46732).,
Werner LEMBERG <=