Various clang 8.0 static analyzer fixes.

Reported by Sender Ghost <lightside@gmx.com>.

* src/autofit/afcjk.c (af_cjk_hints_compute_edges): Catch a corner
case where `edge->first' could be NULL.

* src/pfr/pfrobjs.c (pfr_slot_load): Remove unnecessary test of
`size'.

* src/raster/ftraster.c (Draw_Sweep): Catch a corner case where
`draw_right' might be NULL.

* src/sfnt/ttmtx.c (tt_face_get_metrics): Fix limit test for
`aadvance'.
Ensure `abearing' always hold a meaningful result.

* src/truetype/ttgload.c (load_truetype_glyph): Ensure `subglyph' is
not NULL before accessing it.
* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Remove unnecessary
test of `namedstyle'.

* src/type42/t42parse.c (t42_parser_done): Ensure
`parser->root.funcs.done' is not NULL before accessing it.

ChangeLog

@@ -1,3 +1,30 @@
+2019-05-04  Werner Lemberg  <wl@gnu.org>
+
+	Various clang 8.0 static analyzer fixes.
+
+	Reported by Sender Ghost <lightside@gmx.com>.
+
+	* src/autofit/afcjk.c (af_cjk_hints_compute_edges): Catch a corner
+	case where `edge->first' could be NULL.
+
+	* src/pfr/pfrobjs.c (pfr_slot_load): Remove unnecessary test of
+	`size'.
+
+	* src/raster/ftraster.c (Draw_Sweep): Catch a corner case where
+	`draw_right' might be NULL.
+
+	* src/sfnt/ttmtx.c (tt_face_get_metrics): Fix limit test for
+	`aadvance'.
+	Ensure `abearing' always hold a meaningful result.
+
+	* src/truetype/ttgload.c (load_truetype_glyph): Ensure `subglyph' is
+	not NULL before accessing it.
+	* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Remove unnecessary
+	test of `namedstyle'.
+
+	* src/type42/t42parse.c (t42_parser_done): Ensure
+	`parser->root.funcs.done' is not NULL before accessing it.
+
 2019-05-03  Alexei Podtelezhnikov  <apodtele@gmail.com>
 
 	Miscellaneous macro updates.

src/autofit/afcjk.c

@@ -1184,6 +1184,8 @@
 
 
         seg = edge->first;
+        if ( !seg )
+          goto Skip_Loop;
 
         do
         {
@@ -1239,13 +1241,14 @@
               edge2->flags |= AF_EDGE_SERIF;
             }
             else
-              edge->link  = edge2;
+              edge->link = edge2;
           }
 
           seg = seg->edge_next;
 
         } while ( seg != edge->first );
 
+      Skip_Loop:
         /* set the round/straight flags */
         edge->flags = AF_EDGE_NORMAL;
 

src/cache/rules.mk

@@ -15,7 +15,7 @@
 
 # Cache driver directory
 #
-CACHE_DIR   := $(SRC_DIR)/cache
+CACHE_DIR := $(SRC_DIR)/cache
 
 
 # compilation flags for the driver

src/pfr/pfrobjs.c

@@ -378,7 +378,7 @@
       outline->flags &= ~FT_OUTLINE_OWNER;
       outline->flags |= FT_OUTLINE_REVERSE_FILL;
 
-      if ( size && pfrsize->metrics.y_ppem < 24 )
+      if ( pfrsize->metrics.y_ppem < 24 )
         outline->flags |= FT_OUTLINE_HIGH_PRECISION;
 
       /* compute the advance vector */

src/raster/ftraster.c

@@ -2778,6 +2778,12 @@
       Sort( &draw_left );
       Sort( &draw_right );
 
+      if ( !draw_right )
+      {
+        ras.error = FT_THROW( Invalid );
+        return FAILURE;
+      }
+
       y_change = (Short)ras.sizeBuff[-ras.numTurns--];
       y_height = (Short)( y_change - y );
 

src/sfnt/ttmtx.c

@@ -280,7 +280,7 @@
       else
       {
         table_pos += 4 * ( k - 1 );
-        if ( table_pos + 4 > table_end )
+        if ( table_pos + 2 > table_end )
           goto NoData;
 
         if ( FT_STREAM_SEEK( table_pos ) ||
@@ -292,7 +292,9 @@
           *abearing = 0;
         else
         {
-          if ( !FT_STREAM_SEEK( table_pos ) )
+          if ( FT_STREAM_SEEK( table_pos ) )
+            *abearing = 0;
+          else
             (void)FT_READ_SHORT( *abearing );
         }
       }

src/truetype/ttgload.c

@@ -2088,6 +2088,7 @@
         loader->ins_pos = ins_pos;
         if ( IS_HINTED( loader->load_flags ) &&
 #ifdef TT_USE_BYTECODE_INTERPRETER
+             subglyph                        &&
              subglyph->flags & WE_HAVE_INSTR &&
 #endif
              num_points > start_point )

src/truetype/ttgxvar.c

@@ -3054,7 +3054,7 @@
     if ( instance_index > num_instances )
       goto Exit;
 
-    if ( instance_index > 0 && mmvar->namedstyle )
+    if ( instance_index > 0 )
     {
       FT_Memory     memory = face->root.memory;
       SFNT_Service  sfnt   = (SFNT_Service)face->sfnt;

src/type42/t42parse.c

@@ -226,7 +226,8 @@
     if ( !parser->in_memory )
       FT_FREE( parser->base_dict );
 
-    parser->root.funcs.done( &parser->root );
+    if ( parser->root.funcs.done )
+      parser->root.funcs.done( &parser->root );
   }