From 1b6f1d20b552aadeb4dabd3514e876ca9294cce4 Mon Sep 17 00:00:00 2001
From: suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
Date: Sat, 1 Aug 2009 00:32:16 +0900
Subject: [PATCH] truetype: Truncate the instructions upto 16-bit per a glyph.

---
 ChangeLog              | 7 +++++++
 src/truetype/ttgload.c | 8 +++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 576526ee4..3de1bba27 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2009-07-31  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
+
+	truetype: Truncate the instructions upto 16-bit per a glyph.
+
+	* src/truetype/ttgload.c (TT_Hint_Glyph): Truncate
+	the instructions upto 16-bit length per a glyph.
+
 2009-07-31  suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
 
 	truetype: Cast the numerical operands to 32-bit for LP64 systems.
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 2a0e5d3fb..5d48e8fa3 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -633,7 +633,13 @@
 
 
 #ifdef TT_USE_BYTECODE_INTERPRETER
-    n_ins = loader->glyph->control_len;
+    if ( loader->glyph->control_len > 0xFFFFL )
+    {
+      FT_TRACE1(( "TT_Hint_Glyph: too long instructions " ));
+      FT_TRACE1(( "(0x%lx byte) is truncated\n",
+                 loader->glyph->control_len ));
+    }
+    n_ins = (FT_UInt)( loader->glyph->control_len );
 #endif
 
     origin = zone->cur[zone->n_points - 4].x;