diff options
| author | Liang Qi <liang.qi@qt.io> | 2019-02-08 14:27:19 +0000 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2019-02-08 14:27:19 +0000 |
| commit | 26ebdeff75d9f0f7b1ca2f82c35d7eaa013c0982 (patch) | |
| tree | 88626bb5c88436b0e206907f15224bb035481f6b /src/3rdparty/freetype/src/sfnt/ttkern.c | |
| parent | 30178a22ffde5d216a350910668df0d906aced3b (diff) | |
| parent | fbfacd33be482fa3cf0aa5cffaf7006d538a2f92 (diff) | |
Merge "Merge remote-tracking branch 'origin/5.12' into 5.13" into refs/staging/5.13
Diffstat (limited to 'src/3rdparty/freetype/src/sfnt/ttkern.c')
| -rw-r--r-- | src/3rdparty/freetype/src/sfnt/ttkern.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/3rdparty/freetype/src/sfnt/ttkern.c b/src/3rdparty/freetype/src/sfnt/ttkern.c index 4fccc535ce..68f15a2010 100644 --- a/src/3rdparty/freetype/src/sfnt/ttkern.c +++ b/src/3rdparty/freetype/src/sfnt/ttkern.c @@ -5,7 +5,7 @@ /* Load the basic TrueType kerning table. This doesn't handle */ /* kerning data within the GPOS table at the moment. */ /* */ -/* Copyright 1996-2015 by */ +/* Copyright 1996-2018 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -85,7 +85,7 @@ for ( nn = 0; nn < num_tables; nn++ ) { - FT_UInt num_pairs, length, coverage; + FT_UInt num_pairs, length, coverage, format; FT_Byte* p_next; FT_UInt32 mask = (FT_UInt32)1UL << nn; @@ -107,9 +107,15 @@ if ( p_next > p_limit ) /* handle broken table */ p_next = p_limit; + format = coverage >> 8; + + /* we currently only support format 0 kerning tables */ + if ( format != 0 ) + goto NextTable; + /* only use horizontal kerning tables */ - if ( ( coverage & ~8U ) != 0x0001 || - p + 8 > p_limit ) + if ( ( coverage & 3U ) != 0x0001 || + p + 8 > p_next ) goto NextTable; num_pairs = FT_NEXT_USHORT( p ); @@ -214,8 +220,7 @@ if ( ( face->kern_avail_bits & mask ) == 0 ) goto NextTable; - if ( p + 8 > next ) - goto NextTable; + FT_ASSERT( p + 8 <= next ); /* tested in tt_face_load_kern */ num_pairs = FT_NEXT_USHORT( p ); p += 6; |