Attachment #89113 for bug #124828

Lines 224-229 Link Here

(-)freetype-2.1.7.orig/include/freetype/fterrdef.h (+2 lines)
224	"`ENCODING' field missing" )	224	"`ENCODING' field missing" )
225	FT_ERRORDEF_( Missing_Bbx_Field, 0xB6, \	225	FT_ERRORDEF_( Missing_Bbx_Field, 0xB6, \
226	"`BBX' field missing" )	226	"`BBX' field missing" )
		227	FT_ERRORDEF_( Bbx_Too_Big, 0xB7, \
		228	"`BBX' too big" )
227		229
228		230
229	/* END */	231	/* END */

Lines 1098-1103 Link Here

(-)freetype-2.1.7.orig/src/bdf/bdflib.c (-1 / +21 lines)
1098	#define ERRMSG1 "[line %ld] Missing \"%s\" line.\n"	1098	#define ERRMSG1 "[line %ld] Missing \"%s\" line.\n"
1099	#define ERRMSG2 "[line %ld] Font header corrupted or missing fields.\n"	1099	#define ERRMSG2 "[line %ld] Font header corrupted or missing fields.\n"
1100	#define ERRMSG3 "[line %ld] Font glyphs corrupted or missing fields.\n"	1100	#define ERRMSG3 "[line %ld] Font glyphs corrupted or missing fields.\n"
		1101	#define ERRMSG4 "[line %ld] BBX too big.\n"
1101		1102
1102		1103
1103	static FT_Error	1104	static FT_Error
Lines 1578-1583 Link Here
1578	goto Exit;	1579	goto Exit;
1579	}	1580	}
1580		1581
		1582	/* Check that the encoding is in the range [0,65536] because */
		1583	/* otherwise p->have (a bitmap with static size) overflows. */
		1584	if ( p->glyph_enc >= sizeof(p->have)*8 )
		1585	{
		1586	error = BDF_Err_Invalid_File_Format;
		1587	goto Exit;
		1588	}
		1589
1581	/* Check to see whether this encoding has already been encountered. */	1590	/* Check to see whether this encoding has already been encountered. */
1582	/* If it has then change it to unencoded so it gets added if */	1591	/* If it has then change it to unencoded so it gets added if */
1583	/* indicated. */	1592	/* indicated. */
Lines 1829-1834 Link Here
1829	/* And finally, gather up the bitmap. */	1838	/* And finally, gather up the bitmap. */
1830	if ( ft_memcmp( line, "BITMAP", 6 ) == 0 )	1839	if ( ft_memcmp( line, "BITMAP", 6 ) == 0 )
1831	{	1840	{
		1841	unsigned long bitmap_size;
		1842
1832	if ( !( p->flags & _BDF_BBX ) )	1843	if ( !( p->flags & _BDF_BBX ) )
1833	{	1844	{
1834	/* Missing BBX field. */	1845	/* Missing BBX field. */
Lines 1839-1845 Link Here
1839		1850
1840	/* Allocate enough space for the bitmap. */	1851	/* Allocate enough space for the bitmap. */
1841	glyph->bpr = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3;	1852	glyph->bpr = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3;
1842	glyph->bytes = (unsigned short)( glyph->bpr * glyph->bbx.height );	1853
		1854	bitmap_size = glyph->bpr * glyph->bbx.height;
		1855	if ( bitmap_size > 0xFFFFU )
		1856	{
		1857	FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG4, lineno ));
		1858	error = BDF_Err_Bbx_Too_Big;
		1859	goto Exit;
		1860	}
		1861	else
		1862	glyph->bytes = (unsigned short)bitmap_size;
1843		1863
1844	if ( FT_NEW_ARRAY( glyph->bitmap, glyph->bytes ) )	1864	if ( FT_NEW_ARRAY( glyph->bitmap, glyph->bytes ) )
1845	goto Exit;	1865	goto Exit;

Lines 2278-2284 Link Here

(-)freetype-2.1.7.orig/src/cff/cffgload.c (-1 / +1 lines)
2278	FT_LOCAL_DEF( FT_Error )	2278	FT_LOCAL_DEF( FT_Error )
2279	cff_slot_load( CFF_GlyphSlot glyph,	2279	cff_slot_load( CFF_GlyphSlot glyph,
2280	CFF_Size size,	2280	CFF_Size size,
2281	FT_Int glyph_index,	2281	FT_UInt glyph_index,
2282	FT_Int32 load_flags )	2282	FT_Int32 load_flags )
2283	{	2283	{
2284	FT_Error error;	2284	FT_Error error;

Lines 200-206 FT_BEGIN_HEADER Link Here

(-)freetype-2.1.7.orig/src/cff/cffgload.h (-1 / +1 lines)
200	FT_LOCAL( FT_Error )	200	FT_LOCAL( FT_Error )
201	cff_slot_load( CFF_GlyphSlot glyph,	201	cff_slot_load( CFF_GlyphSlot glyph,
202	CFF_Size size,	202	CFF_Size size,
203	FT_Int glyph_index,	203	FT_UInt glyph_index,
204	FT_Int32 load_flags );	204	FT_Int32 load_flags );
205		205

Lines 2144-2152 Link Here

(-)freetype-2.1.7.orig/src/sfnt/ttcmap.c (-3 / +1 lines)
2144	charmap.encoding = FT_ENCODING_NONE; /* will be filled later */	2144	charmap.encoding = FT_ENCODING_NONE; /* will be filled later */
2145	offset = TT_NEXT_ULONG( p );	2145	offset = TT_NEXT_ULONG( p );
2146		2146
2147	if ( offset &&	2147	if ( offset && offset <= face->cmap_size - 2 )
2148	table + offset + 2 < limit &&
2149	table + offset >= table )
2150	{	2148	{
2151	FT_Byte* cmap = table + offset;	2149	FT_Byte* cmap = table + offset;
2152	volatile FT_UInt format = TT_PEEK_USHORT( cmap );	2150	volatile FT_UInt format = TT_PEEK_USHORT( cmap );

Return to bug 124828