Blame freetype-2.3.11-CVE-2010-2498.patch
|
 |
5d5f33f |
--- freetype-2.3.11/src/pshinter/pshalgo.c 2009-07-03 15:28:24.000000000 +0200
|
|
|
5d5f33f |
+++ freetype-2.3.11/src/pshinter/pshalgo.c 2010-07-13 13:14:22.000000000 +0200
|
|
|
5d5f33f |
@@ -4,7 +4,8 @@
|
|
|
5d5f33f |
/* */
|
|
|
5d5f33f |
/* PostScript hinting algorithm (body). */
|
|
|
5d5f33f |
/* */
|
|
|
5d5f33f |
-/* Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
|
|
|
5d5f33f |
+/* Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 */
|
|
|
5d5f33f |
+/* by */
|
|
|
5d5f33f |
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
|
|
|
5d5f33f |
/* */
|
|
|
5d5f33f |
/* This file is part of the FreeType project, and may only be used */
|
|
|
5d5f33f |
@@ -1690,7 +1691,10 @@
|
|
|
5d5f33f |
/* process secondary hints to `selected' points */
|
|
|
5d5f33f |
if ( num_masks > 1 && glyph->num_points > 0 )
|
|
|
5d5f33f |
{
|
|
|
5d5f33f |
- first = mask->end_point;
|
|
|
5d5f33f |
+ /* the `endchar' op can reduce the number of points */
|
|
|
5d5f33f |
+ first = mask->end_point > glyph->num_points
|
|
|
5d5f33f |
+ ? glyph->num_points
|
|
|
5d5f33f |
+ : mask->end_point;
|
|
|
5d5f33f |
mask++;
|
|
|
5d5f33f |
for ( ; num_masks > 1; num_masks--, mask++ )
|
|
|
5d5f33f |
{
|
|
|
5d5f33f |
@@ -1698,7 +1702,9 @@
|
|
|
5d5f33f |
FT_Int count;
|
|
|
5d5f33f |
|
|
|
5d5f33f |
|
|
|
5d5f33f |
- next = mask->end_point;
|
|
|
5d5f33f |
+ next = mask->end_point > glyph->num_points
|
|
|
5d5f33f |
+ ? glyph->num_points
|
|
|
5d5f33f |
+ : mask->end_point;
|
|
|
5d5f33f |
count = next - first;
|
|
|
5d5f33f |
if ( count > 0 )
|
|
|
5d5f33f |
{
|