commit 52fc03cd74b5f99269698c57a2cc8a5117deaf4c Author: Jonathan Kew jkew@mozilla.com Date: Sat Feb 1 09:24:58 2014 +0000

Bug 966021 - Fix load_truetype_table in the cairo dwrite font backend. r=bas, a=lsblakk --- gfx/cairo/cairo/src/cairo-dwrite-font.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/gfx/cairo/cairo/src/cairo-dwrite-font.cpp b/gfx/cairo/cairo/src/cairo-dwrite-font.cpp index bc97e11..f234421 100644 --- a/gfx/cairo/cairo/src/cairo-dwrite-font.cpp +++ b/gfx/cairo/cairo/src/cairo-dwrite-font.cpp @@ -1052,10 +1052,12 @@ _cairo_dwrite_load_truetype_table(void *scaled_font, return CAIRO_INT_STATUS_UNSUPPORTED; }

- *length = size; - if (buffer) { - memcpy(buffer, data, size); + if (buffer && *length && (UINT32)offset < size) { + size = MIN(size - (UINT32)offset, *length); + memcpy(buffer, (const char*)data + offset, size); } + *length = size; + if (tableContext) { face->dwriteface->ReleaseFontTable(tableContext); }