diff options
author | Khaled Hosny <khaledhosny@eglug.org> | 2014-07-27 23:04:57 +0000 |
---|---|---|
committer | Khaled Hosny <khaledhosny@eglug.org> | 2014-07-27 23:04:57 +0000 |
commit | 4facaae3de37c920d692814269c1d8cba893fb8d (patch) | |
tree | 35d32bcf2205e27bab60c9c57dcbb752818ae76e /Build/source/texk/dvipdfm-x/cff.c | |
parent | 8637534bb66ab060136119b6e8e547c0f4e43ffe (diff) |
Avoid read past 65536 glyphs
git-svn-id: svn://tug.org/texlive/trunk@34745 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipdfm-x/cff.c')
-rw-r--r-- | Build/source/texk/dvipdfm-x/cff.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/Build/source/texk/dvipdfm-x/cff.c b/Build/source/texk/dvipdfm-x/cff.c index b576a8b4f0f..7dd35d44cb0 100644 --- a/Build/source/texk/dvipdfm-x/cff.c +++ b/Build/source/texk/dvipdfm-x/cff.c @@ -301,9 +301,13 @@ cff_get_index_header (cff_font *cff) ERROR("invalid offsize data"); idx->offset = NEW(count+1, l_offset); - for (i=0;i<count+1;i++) { + for (i=0;i<count;i++) { (idx->offset)[i] = get_offset(cff->stream, idx->offsize); } + if (count == 0xFFFF) + cff_seek(cff, cff_tell(cff) + idx->offsize); + else + (idx->offset)[i] = get_offset(cff->stream, idx->offsize); if (idx->offset[0] != 1) ERROR("cff_get_index(): invalid index data"); |