walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[cff] Check rcurveline and rlinecurve arguments 

Make sure the number of arguments is not too many or too few, otherwise
skip the command.
This commit is contained in:
Khaled Hosny 2019-11-17 21:32:12 +02:00
parent 9f1524ce83
commit 57da16bc59
1 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/hb-cff-interp-cs-common.hh
View File

@ -551,8 +551,13 @@ struct path_procs_t
static void rcurveline (ENV &env, PARAM& param)
{
unsigned int arg_count = env.argStack.get_count ();
if (unlikely (arg_count < 8))
return;
unsigned int i = 0;
for (; i + 6 <= env.argStack.get_count (); i += 6)
unsigned int curve_limit = arg_count - 2;
for (; i + 6 <= curve_limit; i += 6)
{
point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1));
@ -562,26 +567,27 @@ struct path_procs_t
pt3.move (env.eval_arg (i+4), env.eval_arg (i+5));
PATH::curve (env, param, pt1, pt2, pt3);
}
for (; i + 2 <= env.argStack.get_count (); i += 2)
{
point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1));
PATH::line (env, param, pt1);
}
}
static void rlinecurve (ENV &env, PARAM& param)
{
unsigned int arg_count = env.argStack.get_count ();
if (unlikely (arg_count < 8))
return;
unsigned int i = 0;
unsigned int line_limit = (env.argStack.get_count () - 6);
unsigned int line_limit = arg_count - 6;
for (; i + 2 <= line_limit; i += 2)
{
point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1));
PATH::line (env, param, pt1);
}
for (; i + 6 <= env.argStack.get_count (); i += 6)
{
point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1));
point_t pt2 = pt1;
@ -590,7 +596,6 @@ struct path_procs_t
pt3.move (env.eval_arg (i+4), env.eval_arg (i+5));
PATH::curve (env, param, pt1, pt2, pt3);
}
}
static void vvcurveto (ENV &env, PARAM& param)
{