emacs-31 95ab9ef627b 1/2: Fix OOB read in Android TrueType font scan

branch: emacs-31
commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe
Author: Paul Eggert <[email protected]>
Commit: Paul Eggert <[email protected]>

    Fix OOB read in Android TrueType font scan
    
    Problem reported privately by Michal Majchrowicz and Marcin
    Wyczechowski, members of the AFINE Team.
    * src/sfnt.c (sfnt_vary_simple_glyph, sfnt_vary_compound_glyph):
    Reject indexes equal exactly to sizes.
---
 src/sfnt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/sfnt.c b/src/sfnt.c
index ab6a2d5e7bc..559825d1804 100644
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -15905,8 +15905,8 @@ sfnt_vary_simple_glyph (struct sfnt_blend *blend, sfnt_glyph id,
 	      sfnt_swap16 (&coords[j]);
 	    }
 	}
-      else if ((index & 0xfff) > gvar->shared_coord_count)
-	/* index exceeds the number of shared tuples present.  */
+      else if (gvar->shared_coord_count <= (index & 0xfff))
+	/* The index is too large.  */
 	goto fail1;
       else
 	/* index points into gvar->axis_count coordinates making up
@@ -16277,8 +16277,8 @@ sfnt_vary_compound_glyph (struct sfnt_blend *blend, sfnt_glyph id,
 	      sfnt_swap16 (&coords[j]);
 	    }
 	}
-      else if ((index & 0xfff) > gvar->shared_coord_count)
-	/* index exceeds the number of shared tuples present.  */
+      else if (gvar->shared_coord_count <= (index & 0xfff))
+	/* The index is too large.  */
 	goto fail1;
       else
 	/* index points into gvar->axis_count coordinates making up