[CHG] FreeType updated to version 2.4.2

This commit is contained in:
Crayon2000 2010-08-08 21:27:38 +00:00
parent 5d78a7117d
commit 69d4eab793
15 changed files with 1018 additions and 821 deletions

View file

@ -363,7 +363,7 @@ FT_BEGIN_HEADER
#endif /* __arm__ && !__thumb__ && !( __CC_ARM || __ARMCC__ ) */ #endif /* __arm__ && !__thumb__ && !( __CC_ARM || __ARMCC__ ) */
#if defined( i386 ) #if defined( __i386__ )
#define FT_MULFIX_ASSEMBLER FT_MulFix_i386 #define FT_MULFIX_ASSEMBLER FT_MulFix_i386
/* documentation is in freetype.h */ /* documentation is in freetype.h */

View file

@ -1952,6 +1952,9 @@ FT_BEGIN_HEADER
/* Each new face object created with this function also owns a */ /* Each new face object created with this function also owns a */
/* default @FT_Size object, accessible as `face->size'. */ /* default @FT_Size object, accessible as `face->size'. */
/* */ /* */
/* See the discussion of reference counters in the description of */
/* @FT_Reference_Face. */
/* */
FT_EXPORT( FT_Error ) FT_EXPORT( FT_Error )
FT_Open_Face( FT_Library library, FT_Open_Face( FT_Library library,
const FT_Open_Args* args, const FT_Open_Args* args,
@ -2016,6 +2019,33 @@ FT_BEGIN_HEADER
FT_Open_Args* parameters ); FT_Open_Args* parameters );
/*************************************************************************/
/* */
/* <Function> */
/* FT_Reference_Face */
/* */
/* <Description> */
/* A counter gets initialized to~1 at the time an @FT_Face structure */
/* is created. This function increments the counter. @FT_Done_Face */
/* then only destroys a face if the counter is~1, otherwise it simply */
/* decrements the counter. */
/* */
/* This function helps in managing life-cycles of structures which */
/* reference @FT_Face objects. */
/* */
/* <Input> */
/* face :: A handle to a target face object. */
/* */
/* <Return> */
/* FreeType error code. 0~means success. */
/* */
/* <Since> */
/* 2.4.2 */
/* */
FT_EXPORT( FT_Error )
FT_Reference_Face( FT_Face face );
/*************************************************************************/ /*************************************************************************/
/* */ /* */
/* <Function> */ /* <Function> */
@ -2031,6 +2061,10 @@ FT_BEGIN_HEADER
/* <Return> */ /* <Return> */
/* FreeType error code. 0~means success. */ /* FreeType error code. 0~means success. */
/* */ /* */
/* <Note> */
/* See the discussion of reference counters in the description of */
/* @FT_Reference_Face. */
/* */
FT_EXPORT( FT_Error ) FT_EXPORT( FT_Error )
FT_Done_Face( FT_Face face ); FT_Done_Face( FT_Face face );
@ -3774,7 +3808,7 @@ FT_BEGIN_HEADER
*/ */
#define FREETYPE_MAJOR 2 #define FREETYPE_MAJOR 2
#define FREETYPE_MINOR 4 #define FREETYPE_MINOR 4
#define FREETYPE_PATCH 1 #define FREETYPE_PATCH 2
/*************************************************************************/ /*************************************************************************/

View file

@ -58,7 +58,7 @@ FT_BEGIN_HEADER
/**************************************************************************** /****************************************************************************
* *
* @func: * @enum:
* FT_LcdFilter * FT_LcdFilter
* *
* @description: * @description:

View file

@ -249,6 +249,33 @@ FT_BEGIN_HEADER
FT_Module module ); FT_Module module );
/*************************************************************************/
/* */
/* <Function> */
/* FT_Reference_Library */
/* */
/* <Description> */
/* A counter gets initialized to~1 at the time an @FT_Library */
/* structure is created. This function increments the counter. */
/* @FT_Done_Library then only destroys a library if the counter is~1, */
/* otherwise it simply decrements the counter. */
/* */
/* This function helps in managing life-cycles of structures which */
/* reference @FT_Library objects. */
/* */
/* <Input> */
/* library :: A handle to a target library object. */
/* */
/* <Return> */
/* FreeType error code. 0~means success. */
/* */
/* <Since> */
/* 2.4.2 */
/* */
FT_EXPORT( FT_Error )
FT_Reference_Library( FT_Library library );
/*************************************************************************/ /*************************************************************************/
/* */ /* */
/* <Function> */ /* <Function> */
@ -275,6 +302,10 @@ FT_BEGIN_HEADER
/* <Return> */ /* <Return> */
/* FreeType error code. 0~means success. */ /* FreeType error code. 0~means success. */
/* */ /* */
/* <Note> */
/* See the discussion of reference counters in the description of */
/* @FT_Reference_Library. */
/* */
FT_EXPORT( FT_Error ) FT_EXPORT( FT_Error )
FT_New_Library( FT_Memory memory, FT_New_Library( FT_Memory memory,
FT_Library *alibrary ); FT_Library *alibrary );
@ -295,6 +326,10 @@ FT_BEGIN_HEADER
/* <Return> */ /* <Return> */
/* FreeType error code. 0~means success. */ /* FreeType error code. 0~means success. */
/* */ /* */
/* <Note> */
/* See the discussion of reference counters in the description of */
/* @FT_Reference_Library. */
/* */
FT_EXPORT( FT_Error ) FT_EXPORT( FT_Error )
FT_Done_Library( FT_Library library ); FT_Done_Library( FT_Library library );

View file

@ -4,7 +4,7 @@
/* */ /* */
/* The FreeType private base classes (specification). */ /* The FreeType private base classes (specification). */
/* */ /* */
/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008 by */ /* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */ /* */
/* This file is part of the FreeType project, and may only be used, */ /* This file is part of the FreeType project, and may only be used, */
@ -311,6 +311,12 @@ FT_BEGIN_HEADER
/* in the case when the unpatented hinter is compiled within the */ /* in the case when the unpatented hinter is compiled within the */
/* library. */ /* library. */
/* */ /* */
/* refcount :: */
/* A counter initialized to~1 at the time an @FT_Face structure is */
/* created. @FT_Reference_Face increments this counter, and */
/* @FT_Done_Face only destroys a face if the counter is~1, */
/* otherwise it simply decrements it. */
/* */
typedef struct FT_Face_InternalRec_ typedef struct FT_Face_InternalRec_
{ {
#ifdef FT_CONFIG_OPTION_OLD_INTERNALS #ifdef FT_CONFIG_OPTION_OLD_INTERNALS
@ -328,6 +334,7 @@ FT_BEGIN_HEADER
#endif #endif
FT_Bool ignore_unpatented_hinter; FT_Bool ignore_unpatented_hinter;
FT_UInt refcount;
} FT_Face_InternalRec; } FT_Face_InternalRec;
@ -805,10 +812,28 @@ FT_BEGIN_HEADER
/* */ /* */
/* debug_hooks :: XXX */ /* debug_hooks :: XXX */
/* */ /* */
/* lcd_filter :: If subpixel rendering is activated, the */
/* selected LCD filter mode. */
/* */
/* lcd_extra :: If subpixel rendering is activated, the number */
/* of extra pixels needed for the LCD filter. */
/* */
/* lcd_weights :: If subpixel rendering is activated, the LCD */
/* filter weights, if any. */
/* */
/* lcd_filter_func :: If subpixel rendering is activated, the LCD */
/* filtering callback function. */
/* */
/* pic_container :: Contains global structs and tables, instead */ /* pic_container :: Contains global structs and tables, instead */
/* of defining them globallly. */ /* of defining them globallly. */
/* */ /* */
/* refcount :: A counter initialized to~1 at the time an */
/* @FT_Library structure is created. */
/* @FT_Reference_Library increments this counter, */
/* and @FT_Done_Library only destroys a library */
/* if the counter is~1, otherwise it simply */
/* decrements it. */
/* */
typedef struct FT_LibraryRec_ typedef struct FT_LibraryRec_
{ {
FT_Memory memory; /* library's memory manager */ FT_Memory memory; /* library's memory manager */
@ -843,6 +868,8 @@ FT_BEGIN_HEADER
FT_PIC_Container pic_container; FT_PIC_Container pic_container;
#endif #endif
FT_UInt refcount;
} FT_LibraryRec; } FT_LibraryRec;

View file

@ -142,7 +142,7 @@
if ( !args ) if ( !args )
return FT_Err_Invalid_Argument; return FT_Err_Invalid_Argument;
memory = library->memory; memory = library->memory;
if ( FT_NEW( stream ) ) if ( FT_NEW( stream ) )
goto Exit; goto Exit;
@ -1574,6 +1574,7 @@
FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n", FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
i, offsets[i], rlen, flags )); i, offsets[i], rlen, flags ));
/* postpone the check of rlen longer than buffer until FT_Stream_Read() */
if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */ if ( ( flags >> 8 ) == 0 ) /* Comment, should not be loaded */
continue; continue;
@ -1613,6 +1614,10 @@
pfb_data[pfb_pos++] = 0; pfb_data[pfb_pos++] = 0;
} }
error = FT_Err_Cannot_Open_Resource;
if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
goto Exit2;
error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen ); error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
if ( error ) if ( error )
goto Exit2; goto Exit2;
@ -1960,9 +1965,9 @@
FT_Error error; FT_Error error;
FT_Driver driver; FT_Driver driver;
FT_Memory memory; FT_Memory memory;
FT_Stream stream = 0; FT_Stream stream = NULL;
FT_Face face = 0; FT_Face face = NULL;
FT_ListNode node = 0; FT_ListNode node = NULL;
FT_Bool external_stream; FT_Bool external_stream;
FT_Module* cur; FT_Module* cur;
FT_Module* limit; FT_Module* limit;
@ -2186,6 +2191,8 @@
internal->transform_delta.x = 0; internal->transform_delta.x = 0;
internal->transform_delta.y = 0; internal->transform_delta.y = 0;
internal->refcount = 1;
} }
if ( aface ) if ( aface )
@ -2271,6 +2278,17 @@
} }
/* documentation is in freetype.h */
FT_EXPORT_DEF( FT_Error )
FT_Reference_Face( FT_Face face )
{
face->internal->refcount++;
return FT_Err_Ok;
}
/* documentation is in freetype.h */ /* documentation is in freetype.h */
FT_EXPORT_DEF( FT_Error ) FT_EXPORT_DEF( FT_Error )
@ -2285,22 +2303,29 @@
error = FT_Err_Invalid_Face_Handle; error = FT_Err_Invalid_Face_Handle;
if ( face && face->driver ) if ( face && face->driver )
{ {
driver = face->driver; face->internal->refcount--;
memory = driver->root.memory; if ( face->internal->refcount > 0 )
/* find face in driver's list */
node = FT_List_Find( &driver->faces_list, face );
if ( node )
{
/* remove face object from the driver's list */
FT_List_Remove( &driver->faces_list, node );
FT_FREE( node );
/* now destroy the object proper */
destroy_face( memory, face, driver );
error = FT_Err_Ok; error = FT_Err_Ok;
else
{
driver = face->driver;
memory = driver->root.memory;
/* find face in driver's list */
node = FT_List_Find( &driver->faces_list, face );
if ( node )
{
/* remove face object from the driver's list */
FT_List_Remove( &driver->faces_list, node );
FT_FREE( node );
/* now destroy the object proper */
destroy_face( memory, face, driver );
error = FT_Err_Ok;
}
} }
} }
return error; return error;
} }
@ -4262,13 +4287,24 @@
/*************************************************************************/ /*************************************************************************/
/* documentation is in ftmodapi.h */
FT_EXPORT_DEF( FT_Error )
FT_Reference_Library( FT_Library library )
{
library->refcount++;
return FT_Err_Ok;
}
/* documentation is in ftmodapi.h */ /* documentation is in ftmodapi.h */
FT_EXPORT_DEF( FT_Error ) FT_EXPORT_DEF( FT_Error )
FT_New_Library( FT_Memory memory, FT_New_Library( FT_Memory memory,
FT_Library *alibrary ) FT_Library *alibrary )
{ {
FT_Library library = 0; FT_Library library = NULL;
FT_Error error; FT_Error error;
@ -4304,6 +4340,8 @@
library->version_minor = FREETYPE_MINOR; library->version_minor = FREETYPE_MINOR;
library->version_patch = FREETYPE_PATCH; library->version_patch = FREETYPE_PATCH;
library->refcount = 1;
/* That's ok now */ /* That's ok now */
*alibrary = library; *alibrary = library;
@ -4360,40 +4398,64 @@
if ( !library ) if ( !library )
return FT_Err_Invalid_Library_Handle; return FT_Err_Invalid_Library_Handle;
library->refcount--;
if ( library->refcount > 0 )
goto Exit;
memory = library->memory; memory = library->memory;
/* Discard client-data */ /* Discard client-data */
if ( library->generic.finalizer ) if ( library->generic.finalizer )
library->generic.finalizer( library ); library->generic.finalizer( library );
/* Close all faces in the library. If we don't do /*
* this, we can have some subtle memory leaks. * Close all faces in the library. If we don't do this, we can have
* some subtle memory leaks.
*
* Example: * Example:
* *
* - the cff font driver uses the pshinter module in cff_size_done * - the cff font driver uses the pshinter module in cff_size_done
* - if the pshinter module is destroyed before the cff font driver, * - if the pshinter module is destroyed before the cff font driver,
* opened FT_Face objects managed by the driver are not properly * opened FT_Face objects managed by the driver are not properly
* destroyed, resulting in a memory leak * destroyed, resulting in a memory leak
*
* Some faces are dependent on other faces, like Type42 faces that
* depend on TrueType faces synthesized internally.
*
* The order of drivers should be specified in driver_name[].
*/ */
{ {
FT_UInt n; FT_UInt m, n;
const char* driver_name[] = { "type42", NULL };
for ( n = 0; n < library->num_modules; n++ ) for ( m = 0;
m < sizeof ( driver_name ) / sizeof ( driver_name[0] );
m++ )
{ {
FT_Module module = library->modules[n]; for ( n = 0; n < library->num_modules; n++ )
FT_List faces;
if ( ( module->clazz->module_flags & FT_MODULE_FONT_DRIVER ) == 0 )
continue;
faces = &FT_DRIVER(module)->faces_list;
while ( faces->head )
{ {
FT_Done_Face( FT_FACE( faces->head->data ) ); FT_Module module = library->modules[n];
if ( faces->head ) const char* module_name = module->clazz->module_name;
FT_TRACE0(( "FT_Done_Library: failed to free some faces\n" )); FT_List faces;
if ( driver_name[m] &&
ft_strcmp( module_name, driver_name[m] ) != 0 )
continue;
if ( ( module->clazz->module_flags & FT_MODULE_FONT_DRIVER ) == 0 )
continue;
FT_TRACE7(( "FT_Done_Library: close faces for %s\n", module_name ));
faces = &FT_DRIVER( module )->faces_list;
while ( faces->head )
{
FT_Done_Face( FT_FACE( faces->head->data ) );
if ( faces->head )
FT_TRACE0(( "FT_Done_Library: failed to free some faces\n" ));
}
} }
} }
} }
@ -4435,6 +4497,8 @@
#endif #endif
FT_FREE( library ); FT_FREE( library );
Exit:
return FT_Err_Ok; return FT_Err_Ok;
} }

View file

@ -287,7 +287,7 @@
{ {
/* check current and new position */ /* check current and new position */
if ( stream->pos >= stream->size || if ( stream->pos >= stream->size ||
stream->pos + count > stream->size ) stream->size - stream->pos < count )
{ {
FT_ERROR(( "FT_Stream_EnterFrame:" FT_ERROR(( "FT_Stream_EnterFrame:"
" invalid i/o; pos = 0x%lx, count = %lu, size = 0x%lx\n", " invalid i/o; pos = 0x%lx, count = %lu, size = 0x%lx\n",

View file

@ -2280,6 +2280,8 @@
/* subsequent `pop' operands should add the arguments, */ /* subsequent `pop' operands should add the arguments, */
/* this is the implementation described for `unknown' other */ /* this is the implementation described for `unknown' other */
/* subroutines in the Type1 spec. */ /* subroutines in the Type1 spec. */
/* */
/* XXX Fix return arguments (see discussion below). */
args -= 2 + ( args[-2] >> 16 ); args -= 2 + ( args[-2] >> 16 );
if ( args < stack ) if ( args < stack )
goto Stack_Underflow; goto Stack_Underflow;
@ -2292,6 +2294,22 @@
FT_TRACE4(( " pop (invalid op)\n" )); FT_TRACE4(( " pop (invalid op)\n" ));
/* XXX Increasing `args' is wrong: After a certain number of */
/* `pop's we get a stack overflow. Reason for doing it is */
/* code like this (actually found in a CFF font): */
/* */
/* 17 1 3 callothersubr */
/* pop */
/* callsubr */
/* */
/* Since we handle `callothersubr' as a no-op, and */
/* `callsubr' needs at least one argument, `pop' can't be a */
/* no-op too as it basically should be. */
/* */
/* The right solution would be to provide real support for */
/* `callothersubr' as done in `t1decode.c', however, given */
/* the fact that CFF fonts with `pop' are invalid, it is */
/* questionable whether it is worth the time. */
args++; args++;
break; break;
@ -2455,7 +2473,10 @@
return CFF_Err_Unimplemented_Feature; return CFF_Err_Unimplemented_Feature;
} }
decoder->top = args; decoder->top = args;
if ( decoder->top - stack >= CFF_MAX_OPERANDS )
goto Stack_Overflow;
} /* general operator processing */ } /* general operator processing */
@ -2728,48 +2749,53 @@
/* now load the unscaled outline */ /* now load the unscaled outline */
error = cff_get_glyph_data( face, glyph_index, error = cff_get_glyph_data( face, glyph_index,
&charstring, &charstring_len ); &charstring, &charstring_len );
if ( !error ) if ( error )
{ goto Glyph_Build_Finished;
error = cff_decoder_prepare( &decoder, size, glyph_index );
if ( !error )
{
error = cff_decoder_parse_charstrings( &decoder,
charstring,
charstring_len );
cff_free_glyph_data( face, &charstring, charstring_len ); error = cff_decoder_prepare( &decoder, size, glyph_index );
if ( error )
goto Glyph_Build_Finished;
error = cff_decoder_parse_charstrings( &decoder,
charstring,
charstring_len );
cff_free_glyph_data( face, &charstring, charstring_len );
if ( error )
goto Glyph_Build_Finished;
#ifdef FT_CONFIG_OPTION_INCREMENTAL #ifdef FT_CONFIG_OPTION_INCREMENTAL
/* Control data and length may not be available for incremental */ /* Control data and length may not be available for incremental */
/* fonts. */ /* fonts. */
if ( face->root.internal->incremental_interface ) if ( face->root.internal->incremental_interface )
{ {
glyph->root.control_data = 0; glyph->root.control_data = 0;
glyph->root.control_len = 0; glyph->root.control_len = 0;
} }
else else
#endif /* FT_CONFIG_OPTION_INCREMENTAL */ #endif /* FT_CONFIG_OPTION_INCREMENTAL */
/* We set control_data and control_len if charstrings is loaded. */ /* We set control_data and control_len if charstrings is loaded. */
/* See how charstring loads at cff_index_access_element() in */ /* See how charstring loads at cff_index_access_element() in */
/* cffload.c. */ /* cffload.c. */
{ {
CFF_Index csindex = &cff->charstrings_index; CFF_Index csindex = &cff->charstrings_index;
if ( csindex->offsets ) if ( csindex->offsets )
{ {
glyph->root.control_data = csindex->bytes + glyph->root.control_data = csindex->bytes +
csindex->offsets[glyph_index] - 1; csindex->offsets[glyph_index] - 1;
glyph->root.control_len = charstring_len; glyph->root.control_len = charstring_len;
}
}
} }
} }
/* save new glyph tables */ Glyph_Build_Finished:
cff_builder_done( &decoder.builder ); /* save new glyph tables, if no error */
if ( !error )
cff_builder_done( &decoder.builder );
/* XXX: anything to do for broken glyph entry? */
} }
#ifdef FT_CONFIG_OPTION_INCREMENTAL #ifdef FT_CONFIG_OPTION_INCREMENTAL

View file

@ -1931,18 +1931,21 @@
y1 = SCALED( point[-2].y ); y1 = SCALED( point[-2].y );
x2 = SCALED( point[-1].x ); x2 = SCALED( point[-1].x );
y2 = SCALED( point[-1].y ); y2 = SCALED( point[-1].y );
x3 = SCALED( point[ 0].x );
y3 = SCALED( point[ 0].y );
if ( flipped ) if ( flipped )
{ {
SWAP_( x1, y1 ); SWAP_( x1, y1 );
SWAP_( x2, y2 ); SWAP_( x2, y2 );
SWAP_( x3, y3 );
} }
if ( point <= limit ) if ( point <= limit )
{ {
x3 = SCALED( point[0].x );
y3 = SCALED( point[0].y );
if ( flipped )
SWAP_( x3, y3 );
if ( Cubic_To( RAS_VARS x1, y1, x2, y2, x3, y3 ) ) if ( Cubic_To( RAS_VARS x1, y1, x2, y2, x3, y3 ) )
goto Fail; goto Fail;
continue; continue;
@ -2495,7 +2498,7 @@
PByte p; PByte p;
p = bits - e1*ras.target.pitch; p = bits - e1 * ras.target.pitch;
if ( ras.target.pitch > 0 ) if ( ras.target.pitch > 0 )
p += ( ras.target.rows - 1 ) * ras.target.pitch; p += ( ras.target.rows - 1 ) * ras.target.pitch;

View file

@ -224,9 +224,10 @@
/*************************************************************************/ /*************************************************************************/
/* */ /* */
/* A simple bounds-checking macro. */ /* Two simple bounds-checking macros. */
/* */ /* */
#define BOUNDS( x, n ) ( (FT_UInt)(x) >= (FT_UInt)(n) ) #define BOUNDS( x, n ) ( (FT_UInt)(x) >= (FT_UInt)(n) )
#define BOUNDSL( x, n ) ( (FT_ULong)(x) >= (FT_ULong)(n) )
#undef SUCCESS #undef SUCCESS
#define SUCCESS 0 #define SUCCESS 0
@ -3281,39 +3282,39 @@
args[0] = FT_PIX_CEIL( args[0] ); args[0] = FT_PIX_CEIL( args[0] );
#define DO_RS \ #define DO_RS \
{ \ { \
FT_ULong I = (FT_ULong)args[0]; \ FT_ULong I = (FT_ULong)args[0]; \
\ \
\ \
if ( BOUNDS( I, CUR.storeSize ) ) \ if ( BOUNDSL( I, CUR.storeSize ) ) \
{ \ { \
if ( CUR.pedantic_hinting ) \ if ( CUR.pedantic_hinting ) \
{ \ { \
ARRAY_BOUND_ERROR; \ ARRAY_BOUND_ERROR; \
} \ } \
else \ else \
args[0] = 0; \ args[0] = 0; \
} \ } \
else \ else \
args[0] = CUR.storage[I]; \ args[0] = CUR.storage[I]; \
} }
#define DO_WS \ #define DO_WS \
{ \ { \
FT_ULong I = (FT_ULong)args[0]; \ FT_ULong I = (FT_ULong)args[0]; \
\ \
\ \
if ( BOUNDS( I, CUR.storeSize ) ) \ if ( BOUNDSL( I, CUR.storeSize ) ) \
{ \ { \
if ( CUR.pedantic_hinting ) \ if ( CUR.pedantic_hinting ) \
{ \ { \
ARRAY_BOUND_ERROR; \ ARRAY_BOUND_ERROR; \
} \ } \
} \ } \
else \ else \
CUR.storage[I] = args[1]; \ CUR.storage[I] = args[1]; \
} }
@ -3322,7 +3323,7 @@
FT_ULong I = (FT_ULong)args[0]; \ FT_ULong I = (FT_ULong)args[0]; \
\ \
\ \
if ( BOUNDS( I, CUR.cvtSize ) ) \ if ( BOUNDSL( I, CUR.cvtSize ) ) \
{ \ { \
if ( CUR.pedantic_hinting ) \ if ( CUR.pedantic_hinting ) \
{ \ { \
@ -3341,7 +3342,7 @@
FT_ULong I = (FT_ULong)args[0]; \ FT_ULong I = (FT_ULong)args[0]; \
\ \
\ \
if ( BOUNDS( I, CUR.cvtSize ) ) \ if ( BOUNDSL( I, CUR.cvtSize ) ) \
{ \ { \
if ( CUR.pedantic_hinting ) \ if ( CUR.pedantic_hinting ) \
{ \ { \
@ -3358,7 +3359,7 @@
FT_ULong I = (FT_ULong)args[0]; \ FT_ULong I = (FT_ULong)args[0]; \
\ \
\ \
if ( BOUNDS( I, CUR.cvtSize ) ) \ if ( BOUNDSL( I, CUR.cvtSize ) ) \
{ \ { \
if ( CUR.pedantic_hinting ) \ if ( CUR.pedantic_hinting ) \
{ \ { \
@ -4679,7 +4680,7 @@
/* first of all, check the index */ /* first of all, check the index */
F = args[0]; F = args[0];
if ( BOUNDS( F, CUR.maxFunc + 1 ) ) if ( BOUNDSL( F, CUR.maxFunc + 1 ) )
goto Fail; goto Fail;
/* Except for some old Apple fonts, all functions in a TrueType */ /* Except for some old Apple fonts, all functions in a TrueType */
@ -4755,7 +4756,7 @@
/* first of all, check the index */ /* first of all, check the index */
F = args[1]; F = args[1];
if ( BOUNDS( F, CUR.maxFunc + 1 ) ) if ( BOUNDSL( F, CUR.maxFunc + 1 ) )
goto Fail; goto Fail;
/* Except for some old Apple fonts, all functions in a TrueType */ /* Except for some old Apple fonts, all functions in a TrueType */
@ -5030,7 +5031,7 @@
L = (FT_ULong)args[0]; L = (FT_ULong)args[0];
if ( BOUNDS( L, CUR.zp2.n_points ) ) if ( BOUNDSL( L, CUR.zp2.n_points ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
{ {
@ -5114,8 +5115,8 @@
K = (FT_UShort)args[1]; K = (FT_UShort)args[1];
L = (FT_UShort)args[0]; L = (FT_UShort)args[0];
if( BOUNDS( L, CUR.zp0.n_points ) || if ( BOUNDS( L, CUR.zp0.n_points ) ||
BOUNDS( K, CUR.zp1.n_points ) ) BOUNDS( K, CUR.zp1.n_points ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
{ {
@ -5769,12 +5770,12 @@
static void static void
Ins_SHZ( INS_ARG ) Ins_SHZ( INS_ARG )
{ {
TT_GlyphZoneRec zp; TT_GlyphZoneRec zp;
FT_UShort refp; FT_UShort refp;
FT_F26Dot6 dx, FT_F26Dot6 dx,
dy; dy;
FT_UShort last_point, i; FT_UShort last_point, i;
if ( BOUNDS( args[0], 2 ) ) if ( BOUNDS( args[0], 2 ) )
@ -5976,8 +5977,8 @@
cvtEntry = (FT_ULong)args[1]; cvtEntry = (FT_ULong)args[1];
point = (FT_UShort)args[0]; point = (FT_UShort)args[0];
if ( BOUNDS( point, CUR.zp0.n_points ) || if ( BOUNDS( point, CUR.zp0.n_points ) ||
BOUNDS( cvtEntry, CUR.cvtSize ) ) BOUNDSL( cvtEntry, CUR.cvtSize ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
CUR.error = TT_Err_Invalid_Reference; CUR.error = TT_Err_Invalid_Reference;
@ -6169,7 +6170,7 @@
/* XXX: UNDOCUMENTED! cvt[-1] = 0 always */ /* XXX: UNDOCUMENTED! cvt[-1] = 0 always */
if ( BOUNDS( point, CUR.zp1.n_points ) || if ( BOUNDS( point, CUR.zp1.n_points ) ||
BOUNDS( cvtEntry, CUR.cvtSize + 1 ) || BOUNDSL( cvtEntry, CUR.cvtSize + 1 ) ||
BOUNDS( CUR.GS.rp0, CUR.zp0.n_points ) ) BOUNDS( CUR.GS.rp0, CUR.zp0.n_points ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
@ -6420,8 +6421,8 @@
p1 = (FT_UShort)args[0]; p1 = (FT_UShort)args[0];
p2 = (FT_UShort)args[1]; p2 = (FT_UShort)args[1];
if ( BOUNDS( args[0], CUR.zp1.n_points ) || if ( BOUNDS( p1, CUR.zp1.n_points ) ||
BOUNDS( args[1], CUR.zp0.n_points ) ) BOUNDS( p2, CUR.zp0.n_points ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
CUR.error = TT_Err_Invalid_Reference; CUR.error = TT_Err_Invalid_Reference;
@ -6950,7 +6951,7 @@
A = (FT_ULong)CUR.stack[CUR.args + 1]; A = (FT_ULong)CUR.stack[CUR.args + 1];
B = CUR.stack[CUR.args]; B = CUR.stack[CUR.args];
if ( BOUNDS( A, CUR.cvtSize ) ) if ( BOUNDSL( A, CUR.cvtSize ) )
{ {
if ( CUR.pedantic_hinting ) if ( CUR.pedantic_hinting )
{ {

View file

@ -150,7 +150,7 @@ FT_BEGIN_HEADER
FT_Bool step_ins; /* true if the interpreter must */ FT_Bool step_ins; /* true if the interpreter must */
/* increment IP after ins. exec */ /* increment IP after ins. exec */
FT_Long cvtSize; FT_ULong cvtSize;
FT_Long* cvt; FT_Long* cvt;
FT_UInt glyphSize; /* glyph instructions buffer size */ FT_UInt glyphSize; /* glyph instructions buffer size */

View file

@ -4,7 +4,7 @@
/* */ /* */
/* Type 42 font parser (body). */ /* Type 42 font parser (body). */
/* */ /* */
/* Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */ /* Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by */
/* Roberto Alameda. */ /* Roberto Alameda. */
/* */ /* */
/* This file is part of the FreeType project, and may only be used, */ /* This file is part of the FreeType project, and may only be used, */
@ -577,6 +577,12 @@
} }
string_size = T1_ToInt( parser ); string_size = T1_ToInt( parser );
if ( string_size < 0 )
{
FT_ERROR(( "t42_parse_sfnts: invalid string size\n" ));
error = T42_Err_Invalid_File_Format;
goto Fail;
}
T1_Skip_PS_Token( parser ); /* `RD' */ T1_Skip_PS_Token( parser ); /* `RD' */
if ( parser->root.error ) if ( parser->root.error )
@ -584,13 +590,14 @@
string_buf = parser->root.cursor + 1; /* one space after `RD' */ string_buf = parser->root.cursor + 1; /* one space after `RD' */
parser->root.cursor += string_size + 1; if ( limit - parser->root.cursor < string_size )
if ( parser->root.cursor >= limit )
{ {
FT_ERROR(( "t42_parse_sfnts: too many binary data\n" )); FT_ERROR(( "t42_parse_sfnts: too many binary data\n" ));
error = T42_Err_Invalid_File_Format; error = T42_Err_Invalid_File_Format;
goto Fail; goto Fail;
} }
else
parser->root.cursor += string_size + 1;
} }
if ( !string_buf ) if ( !string_buf )