from trunk

3 files changed, 15 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index ac909cc7885..f0a620b7b99 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,13 @@
+2010-02-28  Chong Yidong  <cyd@stupidchicken.com>
+
+        * charset.c (load_charset_map_from_file)
+        (load_charset_map_from_vector): Zero out allocated
+        charset_map_entries before using them.
+
+2010-02-27  Andreas Schwab  <schwab@linux-m68k.org>
+
+        * w32uniscribe.c (uniscribe_check_otf): Fix length check.
+
 2010-02-27  Chong Yidong  <cyd@stupidchicken.com>
 
         * font.c (font_parse_fcname): Recognize "Book", "Condensed",
diff --git a/src/charset.c b/src/charset.c
index 1db9ec17ae7..125c9131687 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -531,6 +531,7 @@ load_charset_map_from_file (charset, mapfile, control_flag)
   SAFE_ALLOCA (head, struct charset_map_entries *,
                sizeof (struct charset_map_entries));
   entries = head;
+  bzero (entries, sizeof (struct charset_map_entries));
 
   n_entries = 0;
   eof = 0;
@@ -557,6 +558,7 @@ load_charset_map_from_file (charset, mapfile, control_flag)
           SAFE_ALLOCA (entries->next, struct charset_map_entries *,
                        sizeof (struct charset_map_entries));
           entries = entries->next;
+          bzero (entries, sizeof (struct charset_map_entries));
         }
       idx = n_entries % 0x10000;
       entries->entry[idx].from = from;
@@ -596,6 +598,7 @@ load_charset_map_from_vector (charset, vec, control_flag)
   SAFE_ALLOCA (head, struct charset_map_entries *,
                sizeof (struct charset_map_entries));
   entries = head;
+  bzero (entries, sizeof (struct charset_map_entries));
 
   n_entries = 0;
   for (i = 0; i < len; i += 2)
@@ -632,6 +635,7 @@ load_charset_map_from_vector (charset, vec, control_flag)
           SAFE_ALLOCA (entries->next, struct charset_map_entries *,
                        sizeof (struct charset_map_entries));
           entries = entries->next;
+          bzero (entries, sizeof (struct charset_map_entries));
         }
       idx = n_entries % 0x10000;
       entries->entry[idx].from = from;
diff --git a/src/w32uniscribe.c b/src/w32uniscribe.c
index f2bd0f44b50..cfdf629ceee 100644
--- a/src/w32uniscribe.c
+++ b/src/w32uniscribe.c
@@ -666,7 +666,7 @@ int uniscribe_check_otf (font, otf_spec)
   struct gcpro gcpro1;
 
   /* Check the spec is in the right format.  */
-  if (!CONSP (otf_spec) || Flength (otf_spec) < 3)
+  if (!CONSP (otf_spec) || XINT (Flength (otf_spec)) < 3)
     return 0;
 
   /* Break otf_spec into its components.  */