[Git][freetype/freetype][master] [truetype] Reset localpoints when varyi

From:

Werner Lemberg (@wl)

Subject:

[Git][freetype/freetype][master] [truetype] Reset localpoints when varying cvt.

Date:

Thu, 06 Jan 2022 18:14:58 +0000

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

afb4ca01

by Ben Wagner at 2022-01-06T19:13:00+01:00

[truetype] Reset localpoints when varying cvt.

When iterating over the cvt tuples and reading in the points it is necessary
to set all of `localpoints`, `points`, and `point_count` in all cases.  The
existing code did not reset `localpoints` to `NULL` when there were no
private point numbers.  If the previous tuple did have private point numbers
and set `localpoints` to `ALL_POINTS` this would not be cleared and the
wrong branch would be taken later, leading to possible heap buffer overflow.

* src/truetype/ttgxvar.c (tt_face_vary_cvt): Reset `localpoints` to `NULL`
when it isn't valid.

Fixes: https://crbug.com/1284742

1 changed file:

src/truetype/ttgxvar.c

Changes:

src/truetype/ttgxvar.c


       }
       else
       {
+        localpoints = NULL;
         points      = sharedpoints;
         point_count = spoint_count;
       }

[Prev in Thread]

Current Thread

[Next in Thread]

[Git][freetype/freetype][master] [truetype] Reset localpoints when varying cvt., Werner Lemberg (@wl) <=

...	...	@@ -3476,6 +3476,7 @@
3476	3476	}
3477	3477	else
3478	3478	{
	3479	+ localpoints = NULL;
3479	3480	points = sharedpoints;
3480	3481	point_count = spoint_count;
3481	3482	}