From a42567bf66bec844db9278f86afc852db164e8e3 Mon Sep 17 00:00:00 2001
From: David Turner <david@freetype.org>
Date: Thu, 25 Jan 2007 12:23:37 +0000
Subject: [PATCH] - same CFF loader fix (stricter checking though than Werner's
 version) - document light auto-hinter improvements

---
 ChangeLog          | 12 ++++++++++++
 docs/CHANGES       |  9 +++++++++
 src/cff/cffgload.c |  4 ++--
 src/cff/cffload.c  |  8 +++++---
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 83100798f..844b5cd27 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2007-01-25  David Turner  <david@freetype.org>
+
+	* src/cff/cffload.c (cff_index_get_pointers): fixed a bug in the
+	sanity check which caused the last entry in each index to become
+	empty. since this function is only used to load local and global
+	functions, this meant that any charstring that called the last
+	local/global function would fail.
+
+	* src/cff/cffgload.c: fixed sanity check for empty functions
+
+	* docs/CHANGES: document light auto-hinting improvement
+
 2007-01-25  Werner Lemberg  <wl@gnu.org>
 
 	* src/cff/cffload.c (cff_index_get_pointers): Handle last entry
diff --git a/docs/CHANGES b/docs/CHANGES
index fc39ebfee..7b084a122 100644
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -8,6 +8,15 @@ CHANGES BETWEEN 2.3.0 and 2.3.1
     - A typo  in  a  security  check  introduced  after  version 2.2.1
       prevented FreeType to render some glyphs in CFF fonts.
 
+  II. IMPORTANT CHANGES
+
+    - the light auto-hinting mode has been improved and should generate
+      less blurry text in many cases, without changing spacing. This is
+      done by slightly translating/dilating the outline in the horizontal
+      direction in order to better align its features to the pixel grid.
+
+      since the transform is entirely linear, this still provides very
+      good approximations to the original glyph shapes.
 
 ======================================================================
 
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 5c5ae6159..17ad31f2f 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -2089,7 +2089,7 @@
             zone->limit  = decoder->locals[idx + 1];
             zone->cursor = zone->base;
 
-            if ( !zone->base )
+            if ( !zone->base || zone->limit == zone->base )
             {
               FT_ERROR(( "cff_decoder_parse_charstrings:"
                          " invoking empty subrs!\n" ));
@@ -2131,7 +2131,7 @@
             zone->limit  = decoder->globals[idx + 1];
             zone->cursor = zone->base;
 
-            if ( !zone->base )
+            if ( !zone->base || zone->limit == zone->base )
             {
               FT_ERROR(( "cff_decoder_parse_charstrings:"
                          " invoking empty subrs!\n" ));
diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index a8a776ecf..458d7de82 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -403,11 +403,13 @@
         if ( !offset )
           offset = old_offset;
 
-        /* sanity check for invalid offset tables */
-        else if ( offset     < old_offset     ||
-                  offset - 1 > idx->data_size )
+        /* two sanity checks for invalid offset tables */
+        else if ( offset < old_offset )
           offset = old_offset;
 
+	else if ( offset-1 >= idx->data_size && n < idx->count )
+          offset = old_offset;
+	
         t[n] = idx->bytes + offset - 1;
 
         old_offset = offset;