Commit 655b0597 authored by Owen Taylor's avatar Owen Taylor
Browse files

2003-06-25 Owen Taylor <otaylor@redhat.com>

        * src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign
        num_records until we actually decide to load the table,
        otherwise, we'll segfault in tt_face_free_hdmx.
parent 64557805
2003-06-25 Owen Taylor <otaylor@redhat.com>
* src/sfnt/ttload.c (tt_face_load_hdmx): Don't assign
num_records until we actually decide to load the table,
otherwise, we'll segfault in tt_face_free_hdmx.
2003-06-24 Werner Lemberg <wl@gnu.org> 2003-06-24 Werner Lemberg <wl@gnu.org>
* src/cff/cffdrivr.c (cff_get_glyph_name): Protect agains zero * src/cff/cffdrivr.c (cff_get_glyph_name): Protect agains zero
......
...@@ -1776,6 +1776,7 @@ ...@@ -1776,6 +1776,7 @@
FT_Memory memory = stream->memory; FT_Memory memory = stream->memory;
TT_Hdmx hdmx = &face->hdmx; TT_Hdmx hdmx = &face->hdmx;
FT_Short num_records;
FT_Long num_glyphs; FT_Long num_glyphs;
FT_Long record_size; FT_Long record_size;
...@@ -1793,7 +1794,7 @@ ...@@ -1793,7 +1794,7 @@
goto Exit; goto Exit;
hdmx->version = FT_GET_USHORT(); hdmx->version = FT_GET_USHORT();
hdmx->num_records = FT_GET_SHORT(); num_records = FT_GET_SHORT();
record_size = FT_GET_LONG(); record_size = FT_GET_LONG();
FT_FRAME_EXIT(); FT_FRAME_EXIT();
...@@ -1802,9 +1803,10 @@ ...@@ -1802,9 +1803,10 @@
if ( hdmx->version != 0 ) if ( hdmx->version != 0 )
goto Exit; goto Exit;
if ( FT_NEW_ARRAY( hdmx->records, hdmx->num_records ) ) if ( FT_NEW_ARRAY( hdmx->records, num_records ) )
goto Exit; goto Exit;
hdmx->num_records = num_records;
num_glyphs = face->root.num_glyphs; num_glyphs = face->root.num_glyphs;
record_size -= num_glyphs + 2; record_size -= num_glyphs + 2;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment