freetype/freetype-2.4.9-loop-exit-condition.patch
Marek Kasik e50e9306ff Update to 2.4.9
Fixes various CVEs
Resolves: #806270, #802933
2012-03-30 16:29:22 +02:00

17 lines
647 B
Diff

--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1399,9 +1399,10 @@
FT_Byte* base;
- /* If the next token isn't `dup' we are done. */
- if ( parser->root.cursor + 4 < parser->root.limit &&
- ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
+ /* If we are out of data, or if the next token isn't `dup', */
+ /* we are done. */
+ if ( parser->root.cursor + 4 >= parser->root.limit ||
+ ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
break;
T1_Skip_PS_Token( parser ); /* `dup' */