* src/sfnt/ttcmap.c (tt_face_build_cmaps): Check for pointer
overflow.

* src/sfnt/ttload.c (tt_face_load_hdmx): Protect against bad input.
Don't use FT_QNEW_ARRAY but FT_NEW_ARRAY to make deallocation work
in case of failure.

* src/sfnt/ttsbit.c (Load_SBit_Range): Check range intervals.
(tt_face_load_sbit_strikes): Allocate `strike_sbit_ranges' after
frame test.

* src/truetype/ttgload.c (TTLoad_Simple_Glyph): Add assertion for
`flag'.
5 files changed