From 0edf0986f3be570f5bf90ff245a85c1675f5c9a4 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Wed, 6 Oct 2010 11:52:27 +0200
Subject: [PATCH] [truetype] Improve error handling of `SHZ' bytecode
 instruction. Problem reported by Chris Evans <scarybeasts@gmail.com>.

* src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
---
 ChangeLog               | 7 +++++++
 src/truetype/ttinterp.c | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index afe662dfe..69e73044f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2010-10-06  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Improve error handling of `SHZ' bytecode instruction.
+	Problem reported by Chris Evans <scarybeasts@gmail.com>.
+
+	* src/truetype/ttinterp.c (Ins_SHZ): Check `last_point'.
+
 2010-10-05  Werner Lemberg  <wl@gnu.org>
 
 	Fix Savannah bug #31253.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index bf9189c39..e196dcea0 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -5795,7 +5795,16 @@
     if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 )
       last_point = (FT_UShort)( CUR.zp2.n_points - 1 );
     else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
+    {
       last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] );
+
+      if ( BOUNDS( last_point, CUR.zp2.n_points ) )
+      {
+        if ( CUR.pedantic_hinting )
+          CUR.error = TT_Err_Invalid_Reference;
+        return;
+      }
+    }
     else
       last_point = 0;