From ecc1a9abb65001333ed024e80c7675d8d6eb36a6 Mon Sep 17 00:00:00 2001 From: Nigel Tao Date: Thu, 23 Mar 2017 14:12:53 +1100 Subject: [PATCH] font/sfnt: fix argStack size check for moveto ops. The *moveto ops don't take multiple args or arg pairs. For example, in http://wwwimages.adobe.com/content/dam/Adobe/en/devnet/font/pdfs/5177.Type2.pdf page 16, the rmoveto args are listed as: dx1 dy1 which is not the same as rlineto's args, which can be repeated: {dxa dya}+ Change-Id: I5d13f686e604955909eb0b7e52f20ce5f0522c5d Reviewed-on: https://go-review.googlesource.com/38289 Reviewed-by: David Crawshaw --- font/sfnt/postscript.go | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) diff --git a/font/sfnt/postscript.go b/font/sfnt/postscript.go index 1a00b82..60a8294 100644 --- a/font/sfnt/postscript.go +++ b/font/sfnt/postscript.go @@ -875,37 +875,31 @@ func t2CAppendCubeto(p *psInterpreter, dxa, dya, dxb, dyb, dxc, dyc int32) { func t2CHmoveto(p *psInterpreter) error { t2CReadWidth(p, 1) - if p.argStack.top < 1 { + if p.argStack.top != 1 { return errInvalidCFFTable } - for i := int32(0); i < p.argStack.top; i++ { - p.type2Charstrings.x += p.argStack.a[i] - } + p.type2Charstrings.x += p.argStack.a[0] t2CAppendMoveto(p) return nil } func t2CVmoveto(p *psInterpreter) error { t2CReadWidth(p, 1) - if p.argStack.top < 1 { + if p.argStack.top != 1 { return errInvalidCFFTable } - for i := int32(0); i < p.argStack.top; i++ { - p.type2Charstrings.y += p.argStack.a[i] - } + p.type2Charstrings.y += p.argStack.a[0] t2CAppendMoveto(p) return nil } func t2CRmoveto(p *psInterpreter) error { t2CReadWidth(p, 2) - if p.argStack.top < 2 || p.argStack.top%2 != 0 { + if p.argStack.top != 2 { return errInvalidCFFTable } - for i := int32(0); i < p.argStack.top; i += 2 { - p.type2Charstrings.x += p.argStack.a[i+0] - p.type2Charstrings.y += p.argStack.a[i+1] - } + p.type2Charstrings.x += p.argStack.a[0] + p.type2Charstrings.y += p.argStack.a[1] t2CAppendMoveto(p) return nil }