Correct crash when executing IP within twilight zone

* src/sfnt.c (sfnt_address_zp2, sfnt_address_zp1)
(sfnt_address_zp0): Don't save into X or Y if the zone is set to
the twilight zone and they are NULL.

(cherry picked from commit 54abf10dfeeb890fa46c43f13e6c7468a0d945e4)

diff --git a/src/sfnt.c b/src/sfnt.c
index 36a7fbf3ea033ba1d372681049947f1129f19ff6..41dba8b486e70879b90c41c8128d79caba36e693 100644 (file)
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -8563,8 +8563,12 @@ sfnt_address_zp2 (struct sfnt_interpreter *interpreter,
       if (number >= interpreter->twilight_zone_size)
        TRAP ("address to ZP2 (twilight zone) out of bounds");
 
+      if (!x || !y)
+       goto next;
+
       *x = interpreter->twilight_x[number];
       *y = interpreter->twilight_y[number];
+    next:
 
       if (!x_org || !y_org)
        return;
@@ -8614,8 +8618,12 @@ sfnt_address_zp1 (struct sfnt_interpreter *interpreter,
       if (number >= interpreter->twilight_zone_size)
        TRAP ("address to ZP1 (twilight zone) out of bounds");
 
+      if (!x || !y)
+       goto next;
+
       *x = interpreter->twilight_x[number];
       *y = interpreter->twilight_y[number];
+    next:
 
       if (!x_org || !y_org)
        return;
@@ -8665,8 +8673,12 @@ sfnt_address_zp0 (struct sfnt_interpreter *interpreter,
       if (number >= interpreter->twilight_zone_size)
        TRAP ("address to ZP0 (twilight zone) out of bounds");
 
+      if (!x || !y)
+       goto next;
+
       *x = interpreter->twilight_x[number];
       *y = interpreter->twilight_y[number];
+    next:
 
       if (!x_org || !y_org)
        return;