From 62b6433a81ee7ed6e0ac2d6b09ac85b885046ac3 Mon Sep 17 00:00:00 2001
From: Jeremy Tan <jtanx@outlook.com>
Date: Sun, 30 Jul 2017 10:27:17 +0800
Subject: [PATCH 4/6] parsettf.c: Fix buffer overrun condition
Closes #3090
---
fontforge/parsettf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fontforge/parsettf.c
+++ b/fontforge/parsettf.c
@@ -3504,7 +3504,7 @@
for ( i = 1; i<len; ) {
first = dict->charset[i++] = getushort(ttf);
cnt = getc(ttf);
- for ( j=0; j<cnt; ++j )
+ for ( j=0; j<cnt && i<len; ++j )
dict->charset[i++] = ++first;
}
} else if ( format==2 ) {
