Properly parse TTC tables with digital signatures

* src/sfnt.c (sfnt_read_ttc_header): Don't inadvertently
overwrite first two offsets while reading the digital signature.

(cherry picked from commit 2f59052602e71fb818dd5d671be119793864e712)

diff --git a/src/sfnt.c b/src/sfnt.c
index aa8b49a9ecdde0610f67ce91222730ee2271efb8..36240f4cdffd170381d36933c927125165a790a0 100644 (file)
--- a/src/sfnt.c
+++ b/src/sfnt.c
@@ -6195,7 +6195,7 @@ sfnt_read_ttc_header (int fd)
   size = (SFNT_ENDOF (struct sfnt_ttc_header, ul_dsig_offset,
                      uint32_t)
          - offsetof (struct sfnt_ttc_header, ul_dsig_tag));
-  rc = read (fd, &ttc->ul_dsig_offset, size);
+  rc = read (fd, &ttc->ul_dsig_tag, size);
   if (rc == -1 || rc < size)
     {
       xfree (ttc);
@@ -20631,8 +20631,8 @@ main (int argc, char **argv)
       return 1;
     }
 
-#define FANCY_PPEM 44
-#define EASY_PPEM  44
+#define FANCY_PPEM 14
+#define EASY_PPEM  14
 
   interpreter = NULL;
   head = sfnt_read_head_table (fd, font);