summaryrefslogtreecommitdiffstats
path: root/src/truetype/ttinterp.c
diff options
context:
space:
mode:
authorGeremy Condra <gcondra@google.com>2011-12-16 12:43:20 -0800
committerGeremy Condra <gcondra@google.com>2011-12-16 12:43:20 -0800
commit27811904d8de0ce5591417812ca31163bf5aad60 (patch)
treecb03f6111bcf07f311be09b462bbe1d7391a689f /src/truetype/ttinterp.c
parenta56904260208e9306d661349cc2bddfad8f29019 (diff)
downloadandroid_external_freetype-27811904d8de0ce5591417812ca31163bf5aad60.zip
android_external_freetype-27811904d8de0ce5591417812ca31163bf5aad60.tar.gz
android_external_freetype-27811904d8de0ce5591417812ca31163bf5aad60.tar.bz2
Updated freetype to 2.4.8
This change is to fix a vulnerability in 2.4.7 (CVE-2011-3439). It is taken from http://b/issue?id=5700584. Change-Id: I25a87999bc3ab44d7c7f59e7f04f56895d86bb5d
Diffstat (limited to 'src/truetype/ttinterp.c')
-rw-r--r--src/truetype/ttinterp.c33
1 files changed, 23 insertions, 10 deletions
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 6c4eed6..c62c589 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -5155,25 +5155,38 @@
D = CUR_Func_project( CUR.zp0.cur + L, CUR.zp1.cur + K );
else
{
- FT_Vector* vec1 = CUR.zp0.orus + L;
- FT_Vector* vec2 = CUR.zp1.orus + K;
+ /* XXX: UNDOCUMENTED: twilight zone special case */
-
- if ( CUR.metrics.x_scale == CUR.metrics.y_scale )
+ if ( CUR.GS.gep0 == 0 || CUR.GS.gep1 == 0 )
{
- /* this should be faster */
+ FT_Vector* vec1 = CUR.zp0.org + L;
+ FT_Vector* vec2 = CUR.zp1.org + K;
+
+
D = CUR_Func_dualproj( vec1, vec2 );
- D = TT_MULFIX( D, CUR.metrics.x_scale );
}
else
{
- FT_Vector vec;
+ FT_Vector* vec1 = CUR.zp0.orus + L;
+ FT_Vector* vec2 = CUR.zp1.orus + K;
+
+
+ if ( CUR.metrics.x_scale == CUR.metrics.y_scale )
+ {
+ /* this should be faster */
+ D = CUR_Func_dualproj( vec1, vec2 );
+ D = TT_MULFIX( D, CUR.metrics.x_scale );
+ }
+ else
+ {
+ FT_Vector vec;
- vec.x = TT_MULFIX( vec1->x - vec2->x, CUR.metrics.x_scale );
- vec.y = TT_MULFIX( vec1->y - vec2->y, CUR.metrics.y_scale );
+ vec.x = TT_MULFIX( vec1->x - vec2->x, CUR.metrics.x_scale );
+ vec.y = TT_MULFIX( vec1->y - vec2->y, CUR.metrics.y_scale );
- D = CUR_fast_dualproj( &vec );
+ D = CUR_fast_dualproj( &vec );
+ }
}
}
}