Correctly bisect format 12 and 8 cmap tables

* src/sfnt.c (sfnt_bsearch_above): Cease returning the last
element if it is ordered below the key itself.
(sfnt_lookup_glyph_8, sfnt_lookup_glyph_12): Verify whether the
group returned is NULL.

diff --git a/src/sfnt.c b/src/sfnt.c
index 360b0cd2d4da3766a63de68df54c588fd76eb754..0648e12150ca43ae929ea17e9ff29162afd5777b 100644 (file)
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -1122,8 +1122,8 @@ sfnt_lookup_glyph_2 (sfnt_char character,
          : 0);
 }
 
-/* Like `bsearch'.  However, return the highest element above KEY if
-   it could not be found.  */
+/* Like `bsearch', but return the element ordered exactly above KEY if
+   one exists and KEY itself cannot be located.  */
 
 static void *
 sfnt_bsearch_above (const void *key, const void *base,
@@ -1146,12 +1146,18 @@ sfnt_bsearch_above (const void *key, const void *base,
       mid = low + (high - low) / 2;
       sample = bytes + mid * size;
 
-      if (compar (key, sample) > 0)
+      if ((*compar) (key, sample) > 0)
        low = mid + 1;
       else
        high = mid;
     }
 
+  sample = bytes + low * size;
+
+  if (low == nmemb - 1
+      && (*compar) (key, sample) > 0)
+    return NULL;
+
   return (unsigned char *) bytes + low * size;
 }
 
@@ -1287,7 +1293,7 @@ sfnt_lookup_glyph_8 (sfnt_char character,
                                  sizeof format8->groups[0],
                                  sfnt_compare_char);
 
-      if (group->start_char_code > character)
+      if (!group || group->start_char_code > character)
        /* No glyph matches this group.  */
        return 0;
 
@@ -1336,7 +1342,7 @@ sfnt_lookup_glyph_12 (sfnt_char character,
                                  sizeof format12->groups[0],
                                  sfnt_compare_char);
 
-      if (group->start_char_code > character)
+      if (!group || group->start_char_code > character)
        /* No glyph matches this group.  */
        return 0;