From 287206a96b200f9ab048bb0d83a4dbab8766b9f8 Mon Sep 17 00:00:00 2001
From: Mateusz Jurczyk <mjurczyk@google.com>
Date: Thu, 7 May 2026 13:00:15 +0000
Subject: [PATCH] * src/truetype/ttinterp.c (Ins_WCVTF): Add missing CVT
 copy-on-write protection.

Fixes #1430.
---
 src/truetype/ttinterp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 78a401680..0065fd06e 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -2841,7 +2841,13 @@
         ARRAY_BOUND_ERROR;
     }
     else
+    {
+      Modify_CVT_Check( exc );
+      if ( exc->error )
+        return;
+
       exc->cvt[I] = FT_MulFix( args[1], exc->tt_metrics.scale );
+    }
   }