[freetype2] master 7f63105: [truetype] Sanitizer fix, second try.

[Werner LEMBERG]

branch: master
commit 7f63105c072388e5a5674c0caafc7a560e31c95b
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [truetype] Sanitizer fix, second try.
    
    * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Fix boundary
    tests and use only one slot more.
---
 ChangeLog              |    7 +++++++
 src/truetype/ttgxvar.c |    8 ++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index ba6c185..616fdec 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2016-07-19  Werner Lemberg  <address@hidden>
 
+       [truetype] Sanitizer fix, second try.
+
+       * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Fix boundary
+       tests and use only one slot more.
+
+2016-07-19  Werner Lemberg  <address@hidden>
+
        [truetype] Sanitizer fix.
 
        * src/truetype/ttgxvar.c (ft_var_readpackedpoints): Increase array
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index 033b57f..080e2dd 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -159,9 +159,9 @@
     }
 
     /* in the nested loops below we increase `i' twice; */
-    /* it is faster to simply allocate two more slots   */
+    /* it is faster to simply allocate one more slot    */
     /* than to add another test within the loop         */
-    if ( FT_NEW_ARRAY( points, n + 2 ) )
+    if ( FT_NEW_ARRAY( points, n + 1 ) )
       return NULL;
 
     *point_cnt = n;
@@ -182,7 +182,7 @@
         {
           first      += FT_GET_USHORT();
           points[i++] = first;
-          if ( i == n )
+          if ( i >= n )
             break;
         }
       }
@@ -195,7 +195,7 @@
         {
           first      += FT_GET_BYTE();
           points[i++] = first;
-          if ( i == n )
+          if ( i >= n )
             break;
         }
       }