Skip to content

[bdf] Fix use of uninitialized value.

Ben Wagner requested to merge bungeman/freetype:fix_bdf into master

In _bdf_readstream if the data contained no newline then the buffer would continue to grow and uninitialized data read until either the uninitialized data contained a newline or the buffer reached its maxiumum size. The assumption was that the line was always too long and the buffer had been filled, however this case can also happen when there is not enough data to fill the buffer.

Correct this by properly setting the cursor to the end of the available data, which may be different from the end of the buffer. This may still result in one extra allocation, but only on malformed fonts.

  • src/bdf/bdflib.c (_bfd_readstream): Correctly update cursor. Remove unread set of avail.

Bug: https://lists.nongnu.org/archive/html/freetype-devel/2021-12/msg00001.html

Merge request reports