--- freetype-2.1.3/src/sfnt/ttcmap0-orig.c Thu Nov 7 07:32:54 2002 +++ freetype-2.1.3/src/sfnt/ttcmap0.c Thu Nov 14 18:42:29 2002 @@ -701,9 +701,18 @@ p += offset; /* start of glyph id array */ /* check that we point within the glyph ids table only */ - if ( p < glyph_ids || - p + ( end - start + 1 ) * 2 > table + length ) - FT_INVALID_DATA; + if ( valid->level >= FT_VALIDATE_TIGHT ) + { + if ( p < glyph_ids || + p + ( end - start + 1 ) * 2 > table + length ) + FT_INVALID_DATA; + } + else + { + if ( p < glyph_ids || + p + ( end - start + 1 ) * 2 > valid->limit ) + FT_INVALID_DATA; + } /* check glyph indices within the segment range */ if ( valid->level >= FT_VALIDATE_TIGHT )