Delay setting gasp ranges and count until computed
Previously, the gasp.numRanges
was set and gasp.gaspRanges
was
allocated and assigned before a possible early exit if the frame could
not be entered. It is also possible that the gaspRanges
allocation
could fail but the numRanges
still be set to non-zero. In such cases
an error would be returned, but the face
would have a gasp
in an
inconsistent state which may still be accessed.
- src/sfnt/ttload.c (tt_face_load_gasp): delay setting
gasp.numRanges
andgasp.gaspRanges
until after the ranges are initialized.