Re: Buffer overflow in the autohinting code.

[David Turner]

Hi Ramon,

Thanks for your contribution. Actually, this bug has already been
fixed in the current snapshot. See the end of
http://www.freetype.org/beta8.html for a list of other fixed
bugs.. I try to keep it updated

Cheers,

- David

> 
> Hello,
> 
> I was testing ft2lint and ft2view with arial.ttf from
> http://www.microsoft.com/typography/. They crashed in malloc. The
> problem appears to be a buffer overflow. According to Electic Fence,
> the problem happens in the line:
> 
>           memset( segment, 0, sizeof ( *segment ) ); (ahglyph.c: 647)
> 
> I believe that this patch fixes the bug. However, I am not familiar
> with the code of Freetype, so please review it before accepting. In
> my opinion the problem is that in the function the code in
> ah_outline_load does not take into account that two additional segments
> are needed if AH_HINT_METRICS is on.
>