tree 9cec095e74336a43967fd8171d20f8fc473649f6
parent 6d12e3a0caf7e6c730972cadfdee758b2908ba9c
author Ben Wagner <bungeman@chromium.org> 1634744715 -0400
committer Alexei Podtelezhnikov <apodtele@gmail.com> 1634744715 -0400

[sfnt] Delay setting gasp ranges and count until computed.

Previously, the gasp.numRanges was set and gasp.gaspRanges was
allocated and assigned before a possible early exit if the frame could
not be entered. It is also possible that the gaspRanges allocation
could fail but the numRanges still be set to non-zero. In such cases
an error would be returned, but the face would have a gasp in an
inconsistent state which may still be accessed.

Reported as
  https://bugs.chromium.org/p/chromium/issues/detail?id=1261450

* src/sfnt/ttload.c (tt_face_load_gasp): Delay setting gasp.numRanges
and gasp.gaspRanges until after the ranges are initialized.