[freetype2] master fde0b78 2/2: * src/truetype/ttpload.c (tt_face_load_loca): Sanitize table length.

[Werner LEMBERG]

branch: master
commit fde0b78ccea93f26c618e7e7e1245ac4132c0d7b
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/truetype/ttpload.c (tt_face_load_loca): Sanitize table length.
    
    This trivial fix allows us to accept more fonts.
    
    Problem reported by 張俊芝 <address@hidden>.
---
 ChangeLog              |    8 ++++++++
 src/truetype/ttpload.c |    6 ++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f9a6099..c126f7f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
 2016-12-24  Werner Lemberg  <address@hidden>
 
+       * src/truetype/ttpload.c (tt_face_load_loca): Sanitize table length.
+
+       This trivial fix allows us to accept more fonts.
+
+       Problem reported by 張俊芝 <address@hidden>.
+
+2016-12-24  Werner Lemberg  <address@hidden>
+
        * src/sfnt/sfobjs.c (sfnt_init_face): Fix tracing.
 
 2016-12-22  Werner Lemberg  <address@hidden>
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c
index 0079ebd..95ab470 100644
--- a/src/truetype/ttpload.c
+++ b/src/truetype/ttpload.c
@@ -104,8 +104,7 @@
       if ( table_len >= 0x40000L )
       {
         FT_TRACE2(( "table too large\n" ));
-        error = FT_THROW( Invalid_Table );
-        goto Exit;
+        table_len = 0x3FFFFL;
       }
       face->num_locations = table_len >> shift;
     }
@@ -116,8 +115,7 @@
       if ( table_len >= 0x20000L )
       {
         FT_TRACE2(( "table too large\n" ));
-        error = FT_THROW( Invalid_Table );
-        goto Exit;
+        table_len = 0x1FFFFL;
       }
       face->num_locations = table_len >> shift;
     }