From b43e0f4413b2aafb88be8cb3fb7aaa84ac0b9102 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 17 Mar 2012 06:42:43 +0000
Subject: [type1] Fix Savannah bug #35847.

* src/type1/t1load.c (parse_subrs): Fix the loop exit condition;
we want to exit when we have run out of data.
---
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 4385417..5803fde 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -1399,9 +1399,10 @@
       FT_Byte*  base;
 
 
-      /* If the next token isn't `dup' we are done. */
-      if ( parser->root.cursor + 4 < parser->root.limit            &&
-           ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
+      /* If we are out of data, or if the next token isn't `dup', */
+      /* we are done.                                             */
+      if ( parser->root.cursor + 4 >= parser->root.limit          ||
+          ft_strncmp( (char*)parser->root.cursor, "dup", 3 ) != 0 )
         break;
 
       T1_Skip_PS_Token( parser );       /* `dup' */
--
cgit v0.9.0.2