fontforge/fontforge — pull request #1421 by tshinnic (2014-06-16 22:54:04+00:00)
Title: Fix buffer overrun on multi-char SVG hkern u1="..."

`fontforge/svg.c` routine `SVGGetNames()` scans the argument variable `utf8` (from hkern `u1="..."` or `u2="..."` attribute values) for contained characters, finding the glyph name for each character, and accumulating the total string length needed to copy all of these glyph names into one string. Only it doesn't manage to, having missed the '+' in
```
len += strlen(temp->name)+1;
```

This fix corrects the typo, correctly accumulating the needed string length for use with the following `malloc()`. Tested as not crashing after this fix with one, four, and 28 characters.

Without the fix an hkern element like:
```

```
will cause errors such as:
`Segmentation fault (core dumped)`
As few as three or four characters in one u1="..." will crash FontForge.