| commit | 284956b5b123125c814bb3841c6871ddfb0694a3 | [log] [tgz] |
|---|---|---|
| author | Alexei Podtelezhnikov <apodtele@gmail.com> | Tue Jul 26 12:23:15 2022 -0400 |
| committer | Alexei Podtelezhnikov <apodtele@gmail.com> | Tue Jul 26 12:23:15 2022 -0400 |
| tree | e3b01169a30f2eb2f873e61455964a4c2dbebf76 | |
| parent | 182295cbcf63e0399f5df68f3d8a7e60b8eeecdb [diff] |
[pfr] Fortify the kerning code. Any array index must be strictly less then the array size. Therefore, we must reject indexes that are equal to the array size. Alternatively, we should move the bounds check before the index decrement but that would be confusing. In addition, it is ok to decrement zero (.notdef) and get UINT_MAX, which is then automatically rejected in the bounds check. * src/pfr/pfrobjs.c (pfr_face_get_kerning): Fix the bounds checking.