Re: [ft-devel] [patch] freetype-2.4.1/src/raster/ftraster.c: Decompose_Curve: access past allocated area

[Yuriy Kaminskiy]

Werner LEMBERG wrote:
>> -          x3 = SCALED( point[ 0].x );
>> -          y3 = SCALED( point[ 0].y );
>>  
>>            if ( flipped )
>>            {
>>              SWAP_( x1, y1 );
>>              SWAP_( x2, y2 );
>> -            SWAP_( x3, y3 );
>>            }
>>  
>>            if ( point <= limit )
>>            {
>> +            x3 = SCALED( point[ 0].x );
>> +            y3 = SCALED( point[ 0].y );
>> +            if ( flipped )
>> +            {
>> +              SWAP_( x3, y3 );
>> +            }
> 
> Hmm, this should be equivalent to patch below, right?

No. Your patch invalidates cubic-curve-finishing-contour, original code (and my
patch) handles it. See "else" side of "if ( point <= limit)", it would never hit
with your patch.

> ======================================================================
> 
> 
> --- ftraster.c        2010-08-06 01:47:04.000000000 +0200
> +++ ftraster.c.new    2010-08-06 01:48:43.000000000 +0200
> @@ -1920,7 +1920,7 @@
>            Long  x1, y1, x2, y2, x3, y3;
>  
>  
> -          if ( point + 1 > limit                             ||
> +          if ( point + 2 > limit                             ||
>                 FT_CURVE_TAG( tags[1] ) != FT_CURVE_TAG_CUBIC )
>              goto Invalid_Outline;