diff options
| author | Qt Forward Merge Bot <qt_forward_merge_bot@qt-project.org> | 2019-02-20 01:01:00 +0100 |
|---|---|---|
| committer | Edward Welbourne <edward.welbourne@qt.io> | 2019-02-20 09:51:12 +0100 |
| commit | 035f934d7a798e97bf0213a5d42a3d511132f03d (patch) | |
| tree | 89aa6efdc86864ce479cddca6b9c4ba523c2754a /src/3rdparty/freetype/src/lzw/ftzopen.c | |
| parent | f4cc23cffbe3005f0a522cac938695e87ecd6407 (diff) | |
| parent | da4ab444ffac37514435364d4d3f0ad59d4f9bc3 (diff) | |
Merge remote-tracking branch 'origin/5.13' into dev
Conflicts:
tests/auto/widgets/itemviews/qheaderview/tst_qheaderview.cpp
Added tests/auto/testlib/selftests/expected_crashes_5.txt to work
round the output of the crashes test (which exercises UB, see
QTBUG-73903) being truncated on one test platform.
Change-Id: I9cd3f2639b4e50c3c4513e14629a40bdca8f8273
Diffstat (limited to 'src/3rdparty/freetype/src/lzw/ftzopen.c')
| -rw-r--r-- | src/3rdparty/freetype/src/lzw/ftzopen.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/src/3rdparty/freetype/src/lzw/ftzopen.c b/src/3rdparty/freetype/src/lzw/ftzopen.c index f96bb73d98..2b868ba9f2 100644 --- a/src/3rdparty/freetype/src/lzw/ftzopen.c +++ b/src/3rdparty/freetype/src/lzw/ftzopen.c @@ -8,7 +8,7 @@ /* be used to parse compressed PCF fonts, as found with many X11 server */ /* distributions. */ /* */ -/* Copyright 2005-2015 by */ +/* Copyright 2005-2018 by */ /* David Turner. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -42,7 +42,12 @@ state->buf_total += count; state->in_eof = FT_BOOL( count < state->num_bits ); state->buf_offset = 0; - state->buf_size = ( state->buf_size << 3 ) - ( state->num_bits - 1 ); + + state->buf_size <<= 3; + if ( state->buf_size > state->num_bits ) + state->buf_size -= state->num_bits - 1; + else + return -1; /* not enough data */ if ( count == 0 ) /* end of file */ return -1; @@ -66,7 +71,10 @@ { if ( state->free_ent >= state->free_bits ) { - state->num_bits = ++num_bits; + state->num_bits = ++num_bits; + if ( num_bits > LZW_MAX_BITS ) + return -1; + state->free_bits = state->num_bits < state->max_bits ? (FT_UInt)( ( 1UL << num_bits ) - 256 ) : state->max_free + 1; @@ -366,7 +374,7 @@ { while ( state->stack_top > 0 ) { - --state->stack_top; + state->stack_top--; if ( buffer ) buffer[result] = state->stack[state->stack_top]; |