| ... |
... |
@@ -362,16 +362,16 @@ |
|
362
|
362
|
FT_Byte* p = load->cursor;
|
|
363
|
363
|
FT_Byte* limit = load->limit;
|
|
364
|
364
|
FT_GlyphLoader gloader = load->gloader;
|
|
|
365
|
+ FT_Outline* outline = &gloader->current.outline;
|
|
365
|
366
|
FT_Int n_contours = load->n_contours;
|
|
366
|
|
- FT_Outline* outline;
|
|
367
|
|
- FT_UShort n_ins;
|
|
368
|
367
|
FT_Int n_points;
|
|
|
368
|
+ FT_UShort n_ins;
|
|
369
|
369
|
|
|
370
|
370
|
FT_Byte *flag, *flag_limit;
|
|
371
|
371
|
FT_Byte c, count;
|
|
372
|
372
|
FT_Vector *vec, *vec_limit;
|
|
373
|
373
|
FT_Pos x, y;
|
|
374
|
|
- FT_Short *cont, *cont_limit, prev_cont;
|
|
|
374
|
+ FT_Short *cont, *cont_limit, last;
|
|
375
|
375
|
FT_Int xy_size = 0;
|
|
376
|
376
|
|
|
377
|
377
|
|
| ... |
... |
@@ -380,40 +380,26 @@ |
|
380
|
380
|
if ( error )
|
|
381
|
381
|
goto Fail;
|
|
382
|
382
|
|
|
383
|
|
- /* reading the contours' endpoints & number of points */
|
|
384
|
|
- cont = gloader->current.outline.contours;
|
|
385
|
|
- cont_limit = cont + n_contours;
|
|
386
|
|
-
|
|
387
|
383
|
/* check space for contours array + instructions count */
|
|
388
|
|
- if ( n_contours >= 0xFFF || p + ( n_contours + 1 ) * 2 > limit )
|
|
|
384
|
+ if ( n_contours >= 0xFFF || p + 2 * n_contours + 2 > limit )
|
|
389
|
385
|
goto Invalid_Outline;
|
|
390
|
386
|
|
|
391
|
|
- prev_cont = FT_NEXT_SHORT( p );
|
|
392
|
|
-
|
|
393
|
|
- if ( n_contours > 0 )
|
|
394
|
|
- cont[0] = prev_cont;
|
|
395
|
|
-
|
|
396
|
|
- if ( prev_cont < 0 )
|
|
397
|
|
- goto Invalid_Outline;
|
|
|
387
|
+ /* reading the contours' endpoints & number of points */
|
|
|
388
|
+ cont = outline->contours;
|
|
|
389
|
+ cont_limit = cont + n_contours;
|
|
398
|
390
|
|
|
399
|
|
- for ( cont++; cont < cont_limit; cont++ )
|
|
|
391
|
+ last = -1;
|
|
|
392
|
+ do
|
|
400
|
393
|
{
|
|
401
|
|
- cont[0] = FT_NEXT_SHORT( p );
|
|
402
|
|
- if ( cont[0] <= prev_cont )
|
|
403
|
|
- {
|
|
404
|
|
- /* unordered contours: this is invalid */
|
|
405
|
|
- goto Invalid_Outline;
|
|
406
|
|
- }
|
|
407
|
|
- prev_cont = cont[0];
|
|
408
|
|
- }
|
|
|
394
|
+ *cont = FT_NEXT_SHORT( p );
|
|
409
|
395
|
|
|
410
|
|
- n_points = 0;
|
|
411
|
|
- if ( n_contours > 0 )
|
|
412
|
|
- {
|
|
413
|
|
- n_points = cont[-1] + 1;
|
|
414
|
|
- if ( n_points < 0 )
|
|
|
396
|
+ if ( *cont <= last )
|
|
415
|
397
|
goto Invalid_Outline;
|
|
416
|
|
- }
|
|
|
398
|
+
|
|
|
399
|
+ last = *cont;
|
|
|
400
|
+ } while ( ++cont < cont_limit );
|
|
|
401
|
+
|
|
|
402
|
+ n_points = last + 1;
|
|
417
|
403
|
|
|
418
|
404
|
FT_TRACE5(( " # of points: %d\n", n_points ));
|
|
419
|
405
|
|
| ... |
... |
@@ -422,9 +408,7 @@ |
|
422
|
408
|
if ( error )
|
|
423
|
409
|
goto Fail;
|
|
424
|
410
|
|
|
425
|
|
- if ( p + 2 > limit )
|
|
426
|
|
- goto Invalid_Outline;
|
|
427
|
|
-
|
|
|
411
|
+ /* stace checked above */
|
|
428
|
412
|
n_ins = FT_NEXT_USHORT( p );
|
|
429
|
413
|
|
|
430
|
414
|
FT_TRACE5(( " Instructions size: %u\n", n_ins ));
|
| ... |
... |
@@ -466,8 +450,6 @@ |
|
466
|
450
|
|
|
467
|
451
|
p += n_ins;
|
|
468
|
452
|
|
|
469
|
|
- outline = &gloader->current.outline;
|
|
470
|
|
-
|
|
471
|
453
|
/* reading the point tags */
|
|
472
|
454
|
flag = (FT_Byte*)outline->tags;
|
|
473
|
455
|
flag_limit = flag + n_points;
|
| ... |
... |
@@ -537,7 +519,7 @@ |
|
537
|
519
|
|
|
538
|
520
|
/* reading the Y coordinates */
|
|
539
|
521
|
|
|
540
|
|
- vec = gloader->current.outline.points;
|
|
|
522
|
+ vec = outline->points;
|
|
541
|
523
|
vec_limit = vec + n_points;
|
|
542
|
524
|
flag = (FT_Byte*)outline->tags;
|
|
543
|
525
|
y = 0;
|