From d32ba0b88b0b658674ac631a3fca2108c86bac21 Mon Sep 17 00:00:00 2001 From: Nigel Tao Date: Fri, 4 May 2012 15:42:29 +1000 Subject: [PATCH] freetype: fix overflow when converting from a uint16 glyph index to a file offset. R=bradfitz CC=golang-dev http://codereview.appspot.com/6198043 --- freetype/truetype/truetype.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/freetype/truetype/truetype.go b/freetype/truetype/truetype.go index 58dae1b..28f2859 100644 --- a/freetype/truetype/truetype.go +++ b/freetype/truetype/truetype.go @@ -568,11 +568,11 @@ func (g *GlyphBuf) load(f *Font, i Index, recursion int) error { // Find the relevant slice of f.glyf. var g0, g1 uint32 if f.locaOffsetFormat == locaOffsetFormatShort { - d := data(f.loca[2*i:]) + d := data(f.loca[2*int(i):]) g0 = 2 * uint32(d.u16()) g1 = 2 * uint32(d.u16()) } else { - d := data(f.loca[4*i:]) + d := data(f.loca[4*int(i):]) g0 = d.u32() g1 = d.u32() }