diff options
| author | Matthieu Herrb <matthieu.herrb@laas.fr> | 2006-07-13 10:18:38 -0400 |
|---|---|---|
| committer | Adam Jackson <ajax@benzedrine.nwnk.net> | 2006-07-13 10:18:38 -0400 |
| commit | 1bf657186d19887a0916340b544b5534e29da081 (patch) | |
| tree | 9f354e87a668bd26cb2ad0d3dad693fc7b02aa35 /src/FreeType | |
| parent | 5d39f5fd3048fc413cb07afeffec0c4daa0cc5a4 (diff) | |
Bug #7397: Fix a buffer overflow in Freetype font support.
Diffstat (limited to 'src/FreeType')
| -rw-r--r-- | src/FreeType/fttools.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/FreeType/fttools.c b/src/FreeType/fttools.c index 9251838..5393558 100644 --- a/src/FreeType/fttools.c +++ b/src/FreeType/fttools.c @@ -77,7 +77,7 @@ FTu2a(int slen, FT_Byte *from, char *to, int byte, int max) n = 0; for (i = 0; i < slen; i += 2) { - if(n >= max) + if(n >= max - 1) break; if(HIBYTE(from+i, byte)!=0) *to++='?'; @@ -143,9 +143,10 @@ FTGetEnglishName(FT_Face face, int nid, char *name_return, int name_len) /* Pretend that Apple Roman is ISO 8859-1. */ if(FTGetName(face, nid, TT_PLATFORM_MACINTOSH, TT_MAC_ID_ROMAN, &name)) { len = name.string_len; - if(len > name_len) - len = name_len; + if(len > name_len - 1) + len = name_len - 1; memcpy(name_return, name.string, len); + name_return[len] = '\0'; /* ensure nul terminaison */ return len; } |