summaryrefslogtreecommitdiff
path: root/Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh')
-rw-r--r--Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh51
1 files changed, 31 insertions, 20 deletions
diff --git a/Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh b/Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh
index 93b457cb090..6df978cf13e 100644
--- a/Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh
+++ b/Build/source/libs/harfbuzz/harfbuzz-src/src/OT/glyf/SimpleGlyph.hh
@@ -117,6 +117,28 @@ struct SimpleGlyph
first_flag = (uint8_t) first_flag | FLAG_OVERLAP_SIMPLE;
}
+ static bool read_flags (const HBUINT8 *&p /* IN/OUT */,
+ contour_point_vector_t &points_ /* IN/OUT */,
+ const HBUINT8 *end)
+ {
+ unsigned count = points_.length;
+ for (unsigned int i = 0; i < count;)
+ {
+ if (unlikely (p + 1 > end)) return false;
+ uint8_t flag = *p++;
+ points_.arrayZ[i++].flag = flag;
+ if (flag & FLAG_REPEAT)
+ {
+ if (unlikely (p + 1 > end)) return false;
+ unsigned int repeat_count = *p++;
+ unsigned stop = hb_min (i + repeat_count, count);
+ for (; i < stop;)
+ points_.arrayZ[i++].flag = flag;
+ }
+ }
+ return true;
+ }
+
static bool read_points (const HBUINT8 *&p /* IN/OUT */,
contour_point_vector_t &points_ /* IN/OUT */,
const HBUINT8 *end,
@@ -124,12 +146,12 @@ struct SimpleGlyph
const simple_glyph_flag_t short_flag,
const simple_glyph_flag_t same_flag)
{
- float v = 0;
+ int v = 0;
unsigned count = points_.length;
for (unsigned i = 0; i < count; i++)
{
- uint8_t flag = points_[i].flag;
+ unsigned flag = points_[i].flag;
if (flag & short_flag)
{
if (unlikely (p + 1 > end)) return false;
@@ -157,7 +179,9 @@ struct SimpleGlyph
{
const HBUINT16 *endPtsOfContours = &StructAfter<HBUINT16> (header);
int num_contours = header.numberOfContours;
- if (unlikely (!bytes.check_range (&endPtsOfContours[num_contours - 1]))) return false;
+ assert (num_contours);
+ /* One extra item at the end, for the instruction-count below. */
+ if (unlikely (!bytes.check_range (&endPtsOfContours[num_contours]))) return false;
unsigned int num_points = endPtsOfContours[num_contours - 1] + 1;
points_.alloc (num_points + 4); // Allocate for phantom points, to avoid a possible copy
@@ -171,26 +195,13 @@ struct SimpleGlyph
const HBUINT8 *p = &StructAtOffset<HBUINT8> (&endPtsOfContours[num_contours + 1],
endPtsOfContours[num_contours]);
+ if (unlikely ((const char *) p < bytes.arrayZ)) return false; /* Unlikely overflow */
const HBUINT8 *end = (const HBUINT8 *) (bytes.arrayZ + bytes.length);
-
- /* Read flags */
- for (unsigned int i = 0; i < num_points;)
- {
- if (unlikely (p + 1 > end)) return false;
- uint8_t flag = *p++;
- points_[i++].flag = flag;
- if (flag & FLAG_REPEAT)
- {
- if (unlikely (p + 1 > end)) return false;
- unsigned int repeat_count = *p++;
- unsigned stop = hb_min (i + repeat_count, num_points);
- for (; i < stop;)
- points_.arrayZ[i++].flag = flag;
- }
- }
+ if (unlikely (p >= end)) return false;
/* Read x & y coordinates */
- return read_points (p, points_, end, &contour_point_t::x,
+ return read_flags (p, points_, end)
+ && read_points (p, points_, end, &contour_point_t::x,
FLAG_X_SHORT, FLAG_X_SAME)
&& read_points (p, points_, end, &contour_point_t::y,
FLAG_Y_SHORT, FLAG_Y_SAME);