[Git][freetype/freetype][master] [type1/MM] Safer handle arrays of different types.

[Alexei Podtelezhnikov (@apodtele)]

Alexei Podtelezhnikov pushed to branch master at FreeType / FreeType

Commits:

• b8db8197
  by Alexei Podtelezhnikov (Алексей Подтележников) at 2024-05-12T22:38:38-04:00

  [type1/MM] Safer handle arrays of different types.
  
  * src/type1/t1load.c (parse_blend_design_map): Separately allocate...
  (T1_Done_Blend): ... and free `design_points` and `blend_points`.
  

1 changed file:

• src/type1/t1load.c

Changes:

src/type1/t1load.c

---

...	...	@@ -751,6 +751,7 @@
751	751	PS_DesignMap dmap = blend->design_map + n;
752	752
753	753
	754	+ FT_FREE( dmap->blend_points );
754	755	FT_FREE( dmap->design_points );
755	756	dmap->num_points = 0;
756	757	}
...	...	@@ -1043,9 +1044,9 @@
1043	1044	}
1044	1045
1045	1046	/* allocate design map data */
1046		- if ( FT_QNEW_ARRAY( map->design_points, num_points * 2 ) )
	1047	+ if ( FT_QNEW_ARRAY( map->design_points, num_points ) ||
	1048	+ FT_QNEW_ARRAY( map->blend_points, num_points ) )
1047	1049	goto Exit;
1048		- map->blend_points = (FT_Fixed*)(map->design_points + num_points);
1049	1050	map->num_points = (FT_Byte)num_points;
1050	1051
1051	1052	for ( p = 0; p < num_points; p++ )

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. Manage all notifications · Help