diff options
Diffstat (limited to 'src/3rdparty/freetype/src/sfnt/ttkern.c')
| -rw-r--r-- | src/3rdparty/freetype/src/sfnt/ttkern.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/3rdparty/freetype/src/sfnt/ttkern.c b/src/3rdparty/freetype/src/sfnt/ttkern.c index 4fccc535ce..68f15a2010 100644 --- a/src/3rdparty/freetype/src/sfnt/ttkern.c +++ b/src/3rdparty/freetype/src/sfnt/ttkern.c @@ -5,7 +5,7 @@ /* Load the basic TrueType kerning table. This doesn't handle */ /* kerning data within the GPOS table at the moment. */ /* */ -/* Copyright 1996-2015 by */ +/* Copyright 1996-2018 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -85,7 +85,7 @@ for ( nn = 0; nn < num_tables; nn++ ) { - FT_UInt num_pairs, length, coverage; + FT_UInt num_pairs, length, coverage, format; FT_Byte* p_next; FT_UInt32 mask = (FT_UInt32)1UL << nn; @@ -107,9 +107,15 @@ if ( p_next > p_limit ) /* handle broken table */ p_next = p_limit; + format = coverage >> 8; + + /* we currently only support format 0 kerning tables */ + if ( format != 0 ) + goto NextTable; + /* only use horizontal kerning tables */ - if ( ( coverage & ~8U ) != 0x0001 || - p + 8 > p_limit ) + if ( ( coverage & 3U ) != 0x0001 || + p + 8 > p_next ) goto NextTable; num_pairs = FT_NEXT_USHORT( p ); @@ -214,8 +220,7 @@ if ( ( face->kern_avail_bits & mask ) == 0 ) goto NextTable; - if ( p + 8 > next ) - goto NextTable; + FT_ASSERT( p + 8 <= next ); /* tested in tt_face_load_kern */ num_pairs = FT_NEXT_USHORT( p ); p += 6; |