... |
... |
@@ -117,11 +117,44 @@ |
117
|
117
|
off2 = cid_get_offset( &p, cid->gd_bytes );
|
118
|
118
|
FT_FRAME_EXIT();
|
119
|
119
|
|
120
|
|
- if ( fd_select >= cid->num_dicts ||
|
121
|
|
- off2 > stream->size ||
|
122
|
|
- off1 > off2 )
|
|
120
|
+
|
|
121
|
+ if ( fd_select >= cid->num_dicts )
|
123
|
122
|
{
|
124
|
|
- FT_TRACE0(( "cid_load_glyph: invalid glyph stream offsets\n" ));
|
|
123
|
+ /*
|
|
124
|
+ * fd_select == 0xFF is often used to indicate that the CID
|
|
125
|
+ * has no charstring to be rendered, similar to GID = 0xFFFF
|
|
126
|
+ * in TrueType fonts.
|
|
127
|
+ */
|
|
128
|
+ if ( (cid->fd_bytes == 1 && fd_select == 0xFFU ) ||
|
|
129
|
+ (cid->fd_bytes == 2 && fd_select == 0xFFFFU ) )
|
|
130
|
+ {
|
|
131
|
+ FT_TRACE1(( "cid_load_glyph: fail for glyph_index=%d, "
|
|
132
|
+ "FD number %d is the max integer fitting into %d byte%s\n",
|
|
133
|
+ glyph_index, fd_select, cid->fd_bytes,
|
|
134
|
+ cid->fd_bytes == 1 ? "" : "s" ));
|
|
135
|
+ }
|
|
136
|
+ else
|
|
137
|
+ {
|
|
138
|
+ FT_TRACE0(( "cid_load_glyph: fail for glyph_index=%d, "
|
|
139
|
+ "FD number %d > number of dicts %d\n",
|
|
140
|
+ glyph_index, fd_select, cid->num_dicts ));
|
|
141
|
+ }
|
|
142
|
+ error = FT_THROW( Invalid_Offset );
|
|
143
|
+ goto Exit;
|
|
144
|
+ }
|
|
145
|
+ else if ( off2 > stream->size )
|
|
146
|
+ {
|
|
147
|
+ FT_TRACE0(( "cid_load_glyph: fail for glyph_index=%d, "
|
|
148
|
+ "end of the glyph data is beyond the data stream\n",
|
|
149
|
+ glyph_index ));
|
|
150
|
+ error = FT_THROW( Invalid_Offset );
|
|
151
|
+ goto Exit;
|
|
152
|
+ }
|
|
153
|
+ else if ( off1 > off2 )
|
|
154
|
+ {
|
|
155
|
+ FT_TRACE0(( "cid_load_glyph: fail for glyph_index=%d, "
|
|
156
|
+ "the end position of glyph data is set before the start position\n",
|
|
157
|
+ glyph_index ));
|
125
|
158
|
error = FT_THROW( Invalid_Offset );
|
126
|
159
|
goto Exit;
|
127
|
160
|
}
|
... |
... |
@@ -161,7 +194,9 @@ |
161
|
194
|
cs_offset = decoder->lenIV >= 0 ? (FT_UInt)decoder->lenIV : 0;
|
162
|
195
|
if ( cs_offset > glyph_length )
|
163
|
196
|
{
|
164
|
|
- FT_TRACE0(( "cid_load_glyph: invalid glyph stream offsets\n" ));
|
|
197
|
+ FT_TRACE0(( "cid_load_glyph: fail for glyph_index=%d, "
|
|
198
|
+ "offset to the charstring is beyond glyph length\n",
|
|
199
|
+ glyph_index ));
|
165
|
200
|
error = FT_THROW( Invalid_Offset );
|
166
|
201
|
goto Exit;
|
167
|
202
|
}
|