| ... |
... |
@@ -372,7 +372,6 @@ |
|
372
|
372
|
FT_Vector *vec, *vec_limit;
|
|
373
|
373
|
FT_Pos x, y;
|
|
374
|
374
|
FT_Short *cont, *cont_limit, last;
|
|
375
|
|
- FT_Int xy_size = 0;
|
|
376
|
375
|
|
|
377
|
376
|
|
|
378
|
377
|
/* check that we can add the contours to the glyph */
|
| ... |
... |
@@ -408,11 +407,19 @@ |
|
408
|
407
|
if ( error )
|
|
409
|
408
|
goto Fail;
|
|
410
|
409
|
|
|
411
|
|
- /* stace checked above */
|
|
|
410
|
+ /* space checked above */
|
|
412
|
411
|
n_ins = FT_NEXT_USHORT( p );
|
|
413
|
412
|
|
|
414
|
413
|
FT_TRACE5(( " Instructions size: %u\n", n_ins ));
|
|
415
|
414
|
|
|
|
415
|
+ /* check instructions size */
|
|
|
416
|
+ if ( p + n_ins > limit )
|
|
|
417
|
+ {
|
|
|
418
|
+ FT_TRACE1(( "TT_Load_Simple_Glyph: excessive instruction count\n" ));
|
|
|
419
|
+ error = FT_THROW( Too_Many_Hints );
|
|
|
420
|
+ goto Fail;
|
|
|
421
|
+ }
|
|
|
422
|
+
|
|
416
|
423
|
#ifdef TT_USE_BYTECODE_INTERPRETER
|
|
417
|
424
|
|
|
418
|
425
|
if ( IS_HINTED( load->load_flags ) )
|
| ... |
... |
@@ -421,14 +428,6 @@ |
|
421
|
428
|
FT_Memory memory = exec->memory;
|
|
422
|
429
|
|
|
423
|
430
|
|
|
424
|
|
- /* check instructions size */
|
|
425
|
|
- if ( ( limit - p ) < n_ins )
|
|
426
|
|
- {
|
|
427
|
|
- FT_TRACE1(( "TT_Load_Simple_Glyph: instruction count mismatch\n" ));
|
|
428
|
|
- error = FT_THROW( Too_Many_Hints );
|
|
429
|
|
- goto Fail;
|
|
430
|
|
- }
|
|
431
|
|
-
|
|
432
|
431
|
if ( exec->glyphSize )
|
|
433
|
432
|
FT_FREE( exec->glyphIns );
|
|
434
|
433
|
exec->glyphSize = 0;
|
| ... |
... |
@@ -487,9 +486,6 @@ |
|
487
|
486
|
flag = (FT_Byte*)outline->tags;
|
|
488
|
487
|
x = 0;
|
|
489
|
488
|
|
|
490
|
|
- if ( p + xy_size > limit )
|
|
491
|
|
- goto Invalid_Outline;
|
|
492
|
|
-
|
|
493
|
489
|
for ( ; vec < vec_limit; vec++, flag++ )
|
|
494
|
490
|
{
|
|
495
|
491
|
FT_Pos delta = 0;
|
| ... |
... |
@@ -858,9 +854,6 @@ |
|
858
|
854
|
{
|
|
859
|
855
|
FT_Error error;
|
|
860
|
856
|
|
|
861
|
|
- FT_GlyphLoader gloader = loader->gloader;
|
|
862
|
|
- FT_Outline current_outline = gloader->current.outline;
|
|
863
|
|
-
|
|
864
|
857
|
|
|
865
|
858
|
TT_Set_CodeRange( exec, tt_coderange_glyph, exec->glyphIns, n_ins );
|
|
866
|
859
|
|
| ... |
... |
@@ -872,7 +865,7 @@ |
|
872
|
865
|
return error;
|
|
873
|
866
|
|
|
874
|
867
|
/* store drop-out mode in bits 5-7; set bit 2 also as a marker */
|
|
875
|
|
- current_outline.tags[0] |=
|
|
|
868
|
+ loader->gloader->current.outline.tags[0] |=
|
|
876
|
869
|
( exec->GS.scan_type << 5 ) | FT_CURVE_TAG_HAS_SCANMODE;
|
|
877
|
870
|
}
|
|
878
|
871
|
|
| ... |
... |
@@ -922,10 +915,10 @@ |
|
922
|
915
|
static FT_Error
|
|
923
|
916
|
TT_Process_Simple_Glyph( TT_Loader loader )
|
|
924
|
917
|
{
|
|
925
|
|
- FT_GlyphLoader gloader = loader->gloader;
|
|
926
|
|
- FT_Error error = FT_Err_Ok;
|
|
927
|
|
- FT_Outline* outline;
|
|
928
|
|
- FT_Int n_points;
|
|
|
918
|
+ FT_Error error = FT_Err_Ok;
|
|
|
919
|
+ FT_GlyphLoader gloader = loader->gloader;
|
|
|
920
|
+ FT_Outline* outline = &gloader->current.outline;
|
|
|
921
|
+ FT_Int n_points = outline->n_points;
|
|
929
|
922
|
|
|
930
|
923
|
#ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
|
|
931
|
924
|
FT_Memory memory = loader->face->root.memory;
|
| ... |
... |
@@ -933,11 +926,7 @@ |
|
933
|
926
|
#endif
|
|
934
|
927
|
|
|
935
|
928
|
|
|
936
|
|
- outline = &gloader->current.outline;
|
|
937
|
|
- n_points = outline->n_points;
|
|
938
|
|
-
|
|
939
|
929
|
/* set phantom points */
|
|
940
|
|
-
|
|
941
|
930
|
outline->points[n_points ] = loader->pp1;
|
|
942
|
931
|
outline->points[n_points + 1] = loader->pp2;
|
|
943
|
932
|
outline->points[n_points + 2] = loader->pp3;
|