shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,11 @@

+2018-07-16  Werner Lemberg  <wl@gnu.org>

+

+	* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix off-by-one error.

+

+	Reported as

+

+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9412

+

 2018-07-12  Werner Lemberg  <wl@gnu.org>

 	* src/base/ftoutln.c (FT_Outline_Get_Orientation): Init `cbox'.

--- a/src/truetype/ttgxvar.c

+++ b/src/truetype/ttgxvar.c

@@ -2533,11 +2533,14 @@

       if ( FT_IS_NAMED_INSTANCE( FT_FACE( face ) ) )

       {

-        FT_UInt  idx = (FT_UInt)face->root.face_index >> 16;

+        FT_UInt  instance_index = (FT_UInt)face->root.face_index >> 16;

         c = blend->normalizedcoords + i;

-        n = blend->normalized_stylecoords + idx * mmvar->num_axis + i;

+        n = blend->normalized_stylecoords            +

+            ( instance_index - 1 ) * mmvar->num_axis +

+            i;

+

         for ( j = i; j < mmvar->num_axis; j++, n++, c++ )

           if ( *c != *n )

             have_diff = 1;