blob: 0bbd2fc4e90cea0bafcbfc55e9f799985db810a8 [file] [log] [blame]
--- misc/silgraphite-2.3.1/engine/src/font/TtfUtil.cpp 2009-01-29 08:33:19 UTC
+++ misc/build/silgraphite-2.3.1/engine/src/font/TtfUtil.cpp 2016-03-17 00:06:29 UTC
@@ -1106,7 +1106,7 @@ size_t LocaLookup(gr::gid16 nGlyphId,
// CheckTable verifies the index_to_loc_format is valid
if (read(pTable->index_to_loc_format) == Sfnt::FontHeader::ShortIndexLocFormat)
{ // loca entries are two bytes and have been divided by two
- if (nGlyphId <= (lLocaSize >> 1) - 1) // allow sentinel value to be accessed
+ if (lLocaSize >= 2 && nGlyphId <= (lLocaSize >> 1) - 1) // allow sentinel value to be accessed
{
const uint16 * pTable = reinterpret_cast<const uint16 *>(pLoca);
return (read(pTable[nGlyphId]) << 1);
@@ -1115,7 +1115,7 @@ size_t LocaLookup(gr::gid16 nGlyphId,
if (read(pTable->index_to_loc_format) == Sfnt::FontHeader::LongIndexLocFormat)
{ // loca entries are four bytes
- if (nGlyphId <= (lLocaSize >> 2) - 1)
+ if (lLocaSize >= 4 && nGlyphId <= (lLocaSize >> 2) - 1)
{
const uint32 * pTable = reinterpret_cast<const uint32 *>(pLoca);
return read(pTable[nGlyphId]);