Wed 11 Jan 2012 10:37:13 AM UTC, original submission:
Detected in version 2.3.11, but also found in version 2.8
The function gxv_XStateTable_subtable_setup is calling gxv_set_length_by_ulong_offset with a wrong upper bound.
File: gxvcommn.c
Line: 1325
/* ================= eXtended State Table (for morx) =================== */
FT_LOCAL_DEF( void )
gxv_XStateTable_subtable_setup( FT_ULong table_size,
FT_ULong classTable,
FT_ULong stateArray,
FT_ULong entryTable,
FT_ULong* classTable_length_p,
FT_ULong* stateArray_length_p,
FT_ULong* entryTable_length_p,
GXV_Validator valid )
{
FT_ULong o[3];
FT_ULong* l[3];
FT_ULong buff[4];
o[0] = classTable;
o[1] = stateArray;
o[2] = entryTable;
l[0] = classTable_length_p;
l[1] = stateArray_length_p;
l[2] = entryTable_length_p;
gxv_set_length_by_ulong_offset( o, l, buff, 4, table_size, valid );
}
I suppose the upper bound should be 3!
gxv_set_length_by_ulong_offset( o, l, buff, 3, table_size, valid );
kind regards
|