blob: b07e94d6fb794bfe876d15034e7d80baef045dd7 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
--- engine/src/font/TtfUtil.cpp.orig 2009-01-29 08:33:19 UTC
+++ engine/src/font/TtfUtil.cpp
@@ -1106,7 +1106,7 @@ size_t LocaLookup(gr::gid16 nGlyphId,
// CheckTable verifies the index_to_loc_format is valid
if (read(pTable->index_to_loc_format) == Sfnt::FontHeader::ShortIndexLocFormat)
{ // loca entries are two bytes and have been divided by two
- if (nGlyphId <= (lLocaSize >> 1) - 1) // allow sentinel value to be accessed
+ if (lLocaSize >= 2 && nGlyphId <= (lLocaSize >> 1) - 1) // allow sentinel value to be accessed
{
const uint16 * pTable = reinterpret_cast<const uint16 *>(pLoca);
return (read(pTable[nGlyphId]) << 1);
@@ -1115,7 +1115,7 @@ size_t LocaLookup(gr::gid16 nGlyphId,
if (read(pTable->index_to_loc_format) == Sfnt::FontHeader::LongIndexLocFormat)
{ // loca entries are four bytes
- if (nGlyphId <= (lLocaSize >> 2) - 1)
+ if (lLocaSize >= 4 && nGlyphId <= (lLocaSize >> 2) - 1)
{
const uint32 * pTable = reinterpret_cast<const uint32 *>(pLoca);
return read(pTable[nGlyphId]);
|
