From 2a33275e3af01defc9230aa4b93a6b421cff9861 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Tue, 5 Jan 2010 10:27:15 +0100
Subject: [PATCH] Fix Savannah bug #28395.

* src/truetype/ttdriver.c (Load_Glyph), src/type1/t1gload.c
(T1_Loada_Glyph): Don't check `num_glyphs' if incremental interface
is used.
---
 ChangeLog               |  8 ++++++++
 src/truetype/ttdriver.c | 13 +++++++++++--
 src/type1/t1gload.c     |  7 ++++++-
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 92de4aee8..c80ffdb78 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2010-01-05  Werner Lemberg  <wl@gnu.org>
+
+	Fix Savannah bug #28395.
+
+	* src/truetype/ttdriver.c (Load_Glyph), src/type1/t1gload.c
+	(T1_Loada_Glyph): Don't check `num_glyphs' if incremental interface
+	is used.
+
 2010-01-05  Ken Sharp  <ken.sharp@artifex.com>
 
 	Make Type 1 `seac' operator work with incremental interface.
diff --git a/src/truetype/ttdriver.c b/src/truetype/ttdriver.c
index dca009a10..d4978a93c 100644
--- a/src/truetype/ttdriver.c
+++ b/src/truetype/ttdriver.c
@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    TrueType font driver implementation (body).                          */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009    */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -298,7 +299,15 @@
     if ( !size )
       return TT_Err_Invalid_Size_Handle;
 
-    if ( !face || glyph_index >= (FT_UInt)face->num_glyphs )
+    if ( !face )
+      return TT_Err_Invalid_Argument;
+
+#ifdef FT_CONFIG_OPTION_INCREMENTAL
+    if ( glyph_index >= (FT_UInt)face->num_glyphs &&
+         !face->internal->incremental_interface   )
+#else
+    if ( glyph_index >= (FT_UInt)face->num_glyphs )
+#endif
       return TT_Err_Invalid_Argument;
 
     if ( load_flags & FT_LOAD_NO_HINTING )
diff --git a/src/type1/t1gload.c b/src/type1/t1gload.c
index 16586153f..cc8288d85 100644
--- a/src/type1/t1gload.c
+++ b/src/type1/t1gload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 Glyph Loader (body).                                          */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -287,7 +287,12 @@
 #endif
 
 
+#ifdef FT_CONFIG_OPTION_INCREMENTAL
+    if ( glyph_index >= (FT_UInt)face->root.num_glyphs &&
+         face->root.internal->incremental_interface    )
+#else
     if ( glyph_index >= (FT_UInt)face->root.num_glyphs )
+#endif /* FT_CONFIG_OPTION_INCREMENTAL */
     {
       error = T1_Err_Invalid_Argument;
       goto Exit;