[ft] Freetype crashing

[Robin Watts]

Hi all,

I have a test file here that when fed into MuPDF causes Freetype to die 
with a SEGV.

It seems that in ft_stroker_border_export, we append the border points 
to the outline points; this is great, except border->num_points is an 
int, and outline->num_points is a short, hence we can overflow.

I can share the test file for this via direct email, but I can't post it 
to the list (or to a public bugtracker). I have a patch to fix the 
problem, but I'm the first to admit that it may not be ideal.

I submit it here for your delight, delectation, mocking opportunities etc.

Please let me know if there is anything else I can do to help get this 
fixed in the next version of freetype.

Merry Xmas!

Robin

freetype-SEGV.patch
Description: Text document