From dd89710f0f643eb0f99a3830e0712d26c7642acd Mon Sep 17 00:00:00 2001

From: Werner Lemberg <wl@gnu.org>

Date: Fri, 21 Nov 2014 21:19:28 +0000

Subject: [type1, type42] Fix Savannah bug #43655.

* src/type1/t1load.c (parse_charstrings), src/type42/t42parse.c

(t42_parse_charstrings): Fix boundary testing.

---

diff --git a/src/type1/t1load.c b/src/type1/t1load.c

index fd06432..caa75bd 100644

--- a/src/type1/t1load.c

+++ b/src/type1/t1load.c

@@ -1602,7 +1602,7 @@

         FT_PtrDist  len;

-        if ( cur + 1 >= limit )

+        if ( cur + 2 >= limit )

         {

           error = T1_Err_Invalid_File_Format;

           goto Fail;

diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c

index 9b66888..a60e216 100644

--- a/src/type42/t42parse.c

+++ b/src/type42/t42parse.c

@@ -837,7 +837,7 @@

         FT_PtrDist  len;

-        if ( cur + 1 >= limit )

+        if ( cur + 2 >= limit )

         {

           FT_ERROR(( "t42_parse_charstrings: out of bounds\n" ));

           error = T42_Err_Invalid_File_Format;

--

cgit v0.9.0.2