AuroraMiddleware/harfbuzz
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Check rcurveline and rlinecurve arguments

Browse Source 
Make sure the number of arguments is not too many or too few, otherwise
skip the command.
This commit is contained in:
Khaled Hosny 2019-11-17 21:32:12 +02:00
parent 9f1524ce83
commit 57da16bc59
1 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
src/hb-cff-interp-cs-common.hh
View File

@ -551,8 +551,13 @@ struct path_procs_t
static void rcurveline (ENV &env, PARAM& param) static void rcurveline (ENV &env, PARAM& param)
{ {
unsigned int arg_count = env.argStack.get_count ();
if (unlikely (arg_count < 8))
return;
unsigned int i = 0; unsigned int i = 0;
for (; i + 6 <= env.argStack.get_count (); i += 6) unsigned int curve_limit = arg_count - 2;
for (; i + 6 <= curve_limit; i += 6)
{ {
point_t pt1 = env.get_pt (); point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1)); pt1.move (env.eval_arg (i), env.eval_arg (i+1));
@ -562,34 +567,34 @@ struct path_procs_t
pt3.move (env.eval_arg (i+4), env.eval_arg (i+5)); pt3.move (env.eval_arg (i+4), env.eval_arg (i+5));
PATH::curve (env, param, pt1, pt2, pt3); PATH::curve (env, param, pt1, pt2, pt3);
} }
for (; i + 2 <= env.argStack.get_count (); i += 2)
{ point_t pt1 = env.get_pt ();
point_t pt1 = env.get_pt (); pt1.move (env.eval_arg (i), env.eval_arg (i+1));
pt1.move (env.eval_arg (i), env.eval_arg (i+1)); PATH::line (env, param, pt1);
PATH::line (env, param, pt1);
}
} }
static void rlinecurve (ENV &env, PARAM& param) static void rlinecurve (ENV &env, PARAM& param)
{ {
unsigned int arg_count = env.argStack.get_count ();
if (unlikely (arg_count < 8))
return;
unsigned int i = 0; unsigned int i = 0;
unsigned int line_limit = (env.argStack.get_count () - 6); unsigned int line_limit = arg_count - 6;
for (; i + 2 <= line_limit; i += 2) for (; i + 2 <= line_limit; i += 2)
{ {
point_t pt1 = env.get_pt (); point_t pt1 = env.get_pt ();
pt1.move (env.eval_arg (i), env.eval_arg (i+1)); pt1.move (env.eval_arg (i), env.eval_arg (i+1));
PATH::line (env, param, pt1); PATH::line (env, param, pt1);
} }
for (; i + 6 <= env.argStack.get_count (); i += 6)
{ point_t pt1 = env.get_pt ();
point_t pt1 = env.get_pt (); pt1.move (env.eval_arg (i), env.eval_arg (i+1));
pt1.move (env.eval_arg (i), env.eval_arg (i+1)); point_t pt2 = pt1;
point_t pt2 = pt1; pt2.move (env.eval_arg (i+2), env.eval_arg (i+3));
pt2.move (env.eval_arg (i+2), env.eval_arg (i+3)); point_t pt3 = pt2;
point_t pt3 = pt2; pt3.move (env.eval_arg (i+4), env.eval_arg (i+5));
pt3.move (env.eval_arg (i+4), env.eval_arg (i+5)); PATH::curve (env, param, pt1, pt2, pt3);
PATH::curve (env, param, pt1, pt2, pt3);
}
} }
static void vvcurveto (ENV &env, PARAM& param) static void vvcurveto (ENV &env, PARAM& param)