[Devel] load_truetype_glyph fails to make room for subglyphs?

[Keith Packard]

I caught load_truetype_glyph walking off the end of the 'org' array when 
appending a subglyph to a composite glyph; it appears to me that someone 
isn't checking to make sure there's enough space before moving the data 
across.  I hacked a check to make sure sufficient space was available 
before the copy to avoid a crash, but I doubt this is the right solution.
I'm using the Times.TTF that one can get from redmond; I'm displaying every
glyph in the Unicode encoding table; it's crashing when appending glyph
index 141 to glyph index 471

address@hidden   XFree86 Core Team              SuSE, Inc.

This diff is from 2.0.2, but current CVS is essentially the same.

Index: src/truetype/ttgload.c
===================================================================
RCS file: /home/x-cvs/xc/extras/freetype2/src/truetype/ttgload.c,v
retrieving revision 1.1.1.2
diff -u -r1.1.1.2 ttgload.c
--- src/truetype/ttgload.c      2001/05/16 03:45:40     1.1.1.2
+++ src/truetype/ttgload.c      2001/05/16 09:30:30
@@ -971,6 +971,10 @@
             }
           }
 
+         error = FT_GlyphLoader_Check_Points( gloader, num_new_points, 0 );
+         if ( error )
+           goto Fail;
+
           translate_array( num_new_points, loader->zone.cur, x, y );
           cur_to_org( num_new_points, &loader->zone );
         }