Commit Graph

335 Commits

Author SHA1 Message Date
Werner Lemberg addb2dddb6 [base, cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2060
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2062
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2063
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2068

* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.

* src/cff/cf2blues.c (cf2_blues_capture), src/cff/cf2hints.c
(cf2_hintmap_adjustHints): Use OVERFLOW_SUB_INT32.

* src/truetype/ttgload.c (compute_glyph_metrics): User
OVERFLOW_SUB_LONG.

* src/truetype/ttinterp.c (Direct_Move, Direct_Move_Orig,
Direct_Move_X, Direct_Move_Y, Direct_Move_Orig_X,
Direct_Move_Orig_Y, Move_Zp2_Point, Ins_MSIRP): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.
2017-06-03 21:05:42 +02:00
Nikolaus Waxweiler a0455468fd [truetype] Always use interpreter v35 for B/W rendering (#51051).
* src/truetype/ttgload.c (tt_loader_init)
[TT_SUPPORT_SUBPIXEL_HINTING_MINIMAL]: Adjust
`subpixel_hinting_lean', `grayscale_cleartype', and
`vertical_lcd_lean' accordingly.

* src/truetype/ttinterp.c (Ins_GETINFO): Updated.
(TT_RunIns): Update `backward_compatibility' flag.
2017-05-20 07:28:46 +02:00
Werner Lemberg 6e5445a232 [truetype] Fix error handling for embedded bitmaps.
Problem reported by Hin-Tak Leung <htl10@users.sourceforge.net>.

* src/truetype/ttgload.c (TT_Load_Glyph)
[TT_CONFIG_OPTION_EMBEDDED_BITMAPS]: Handle error if font is not
scalable.
2017-05-15 21:24:04 +02:00
Werner Lemberg 8cd31eb7b0 */*: s/backwards compatibility/backward compatibility/. 2017-05-03 23:54:29 +02:00
Werner Lemberg ba40054c2d [autofit] Remove `slight' auto-hint mode again.
A poll on freetype-devel favoured changes directly applied to
`light'.

* include/freetype/freetype.h (FT_LOAD_TARGET_SLIGHT,
FT_RENDER_MODE_SLIGHT): Removed.

* src/autofit/afcjk.c (af_cjk_hints_init), src/autofit/aflatin.c
(af_latin_hints_init), src/autofit/aflatin2.c
(af_latin2_hints_init): Revert change from 2017-04-22.

* src/autofit/afloader.c (af_loader_load_glyph) Remove references to
FT_RENDER_MODE_SLIGHT.
[AF_CONFIG_OPTION_TT_SIZE_METRICS]: Enable TrueType-like metrics
unconditionally.

* src/base/ftadvanc.c (LOAD_ADVANCE_FAST_CHECK): Revert change from
2017-04-22.

* src/base/ftobjs.c (FT_Load_Glyph): Revert change from 2017-04-22.

* src/pshinter/pshalgo.c (ps_hints_apply): Revert change from
2017-04-22.

* src/smooth/ftsmooth.c (ft_smooth_render): Revert change from
2017-04-22.

* docs/CHANGES: Updated.
2017-05-02 12:32:19 +02:00
Werner Lemberg 5f18d867c0 [truetype] Do linear scaling for FT_LOAD_NO_HINTING (#50470).
* src/truetype/ttobs.h (TT_SizeRec): Add field `hinted_metrics' to
hold hinted metrics.
Make `metrics' a pointer so that `tt_glyph_load' can easily switch
between metrics.

* src/truetype/ttdriver.c (tt_size_request): Updated.
(tt_glyph_load): Use top-level metrics if FT_LOAD_NO_HINTING is
used.

* src/truetype/ttgload.c (TT_Hint_Glyph, TT_Process_Simple_Glyph,
TT_Process_Composite_Component, load_truetype_glyph,
compute_glyph_metrics, TT_Load_Glyph): Updated.

* src/truetype/ttinterp.c (TT_Load_Context): Updated.

* src/truetype/ttobjs.c (tt_size_reset): Updated.

* src/truetype/ttsubpix.c (sph_set_tweaks): Updated.
2017-04-26 11:40:28 +02:00
Werner Lemberg bb6c037bae * src/truetype/ttgload.c: Include FT_CONFIG_CONFIG_H.
Otherwise FT_UINT_TO_POINTER might not be defined.

Problem reported by Alexei.
2017-04-01 09:49:11 +02:00
Werner Lemberg bcc74f4daf [truetype] Allow linear scaling for unhinted rendering (#50470).
* src/truetype/ttdriver.c (tt_size_request): Revert change from
2011-07-16; the intended metrics fix seems now to be implemented in
a different way, making the patch unnecessary.  Note that this
change was usually patched out by all major GNU/Linux distributions
due to heavy side effects.

* src/truetype/ttgload.c (compute_glyph_metrics, TT_Load_Glyph):
Refer to the metrics of the `TT_Size' object.
2017-03-30 13:14:43 +02:00
Werner Lemberg 208e712de0 [cid, truetype] Don't use `index' as a variable name.
At least on FreeBSD there is a global declaration of `index' in file
`/usr/include/strings.h'.

* src/cff/cf2intrp.c, src/truetype/ttgload.c: s/index/idx/ where
appropriate.
2017-03-27 20:56:23 +02:00
Werner Lemberg 683e3ad936 [truetype] Some variable renamings.
Too much local variables holding different structures were called
`metrics'.

* src/truetype/ttdriver.c (tt_size_select): s/metrics/size_metrics/.

* src/truetype/ttgload.c (tt_get_metrics_incr_overrids,
compute_glyph_metrics): s/metrics/incr_metrics/.
(load_sbit_image): s/metrics/sbit_metrics/.

* src/truetype/ttobjs.c (tt_size_run_fpgm): s/metrics/size_metrics/.
(tt_size_init_bytecode): s/metrics/tt_metrics/.
(tt_size_reset): s/metrics/size_metrics/.
2017-03-21 19:49:11 +01:00
Werner Lemberg 7aeee3c50f Introduce FT_UINT_TO_POINTER macro (#50560).
We have to make a separate case for Windows 64's LLP64 data model.

* builds/unix/ftconfig.in, builds/vms/ftconfig.h,
include/freetype/config/ftconfig.h (FT_UINT_TO_POINTER): New macro.

* src/truetype/ttgload.c (load_truetype_glyph): Use it.
2017-03-18 17:30:42 +01:00
Werner Lemberg d5bfa053f5 Fixes for conditional compilation.
* src/autofit/afcjk.c, src/autofit/afindic.c: Include `afcjk.h'
earlier.

* src/sfnt/sfobjs.c (sfnt_init_face): Put `memory' variable into
TT_CONFIG_OPTION_GX_VAR_SUPPORT block.
(sfnt_done_face): Protect some code with
TT_CONFIG_OPTION_GX_VAR_SUPPORT.

* src/sfnt/ttsbit.c (tt_face_load_sbix_image): Remove compiler
warning.

* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Put `tmp' variable
into TT_USE_BYTECODE_INTERPRETER block.

(tt_loader_init): Put `error' variable into
TT_USE_BYTECODE_INTERPRETER block.
2017-03-17 21:47:54 +01:00
Werner Lemberg 01f315f076 [truetype] Minor improvement.
* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Remove unnecessary tests.
2017-02-28 15:27:43 +01:00
Werner Lemberg 563ae78022 Update copyright year. 2017-01-04 20:16:34 +01:00
Werner Lemberg 8982405f0c [truetype] Various minor fixes.
* src/truetype/ttgload.c (TT_Load_Simple_Glyph): Check instruction
size only if we do native hinting.
(TT_Load_Glyph): Trace returned error code.

* src/truetype/ttobjs.c (tt_size_run_fpgm, tt_size_run_prep): Trace
returned error code.
(tt_size_ready_bytecode): Don't run `prep' table if `fpgm' table is
invalid.
2017-01-03 09:46:19 +01:00
Werner Lemberg 4441f7b246 Replace `foo == NULL' and `foo != NULL' with `!foo' and `foo', resp.
Other minor formatting.
2016-12-26 17:08:17 +01:00
Werner Lemberg e6a429e2c7 [cff, truetype] Another try for #49829.
* src/cff/cffdrivr.c: Don't include
`FT_SERVICE_METRICS_VARIATIONS_H'.
(cff_get_advances): Use `ttface->variation_support'.

* src/truetype/ttdriver.c (tt_get_advances): Use
`ttface->variation_support'.

* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Use `ttface->variation_support'.
2016-12-21 20:27:48 +01:00
Ben Wagner cc576f8002 [truetype] Fix linear metrics of GX variation fonts.
When asking for an unhinted non-default variations,
`linearVertAdvance' is currently the value from the `hmtx' table
instead of the actual value after applying the variation.  `HVAR'
support fixes this, but fonts will exist without that table and will
need sane fallback.

* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Implement linear advance adjustments if `HVAR'
or `VVAR' tables are missing.
2016-12-20 11:37:42 +01:00
Werner Lemberg eb6d02087b Minor GX code shuffling.
* include/freetype/internal/tttypes.h (TT_Face): Move
`is_default_instance' into TT_CONFIG_OPTION_GX_VAR_SUPPORT
block.

* src/sfnt/sfobjs.c (sfnt_init_face): Updated.
* src/truetype/ttgload.c (IS_DEFAULT_INSTANCE): New macro.
(TT_Load_Glyph): Use it.
2016-12-18 09:29:58 +01:00
Werner Lemberg 5d664b6d51 Use FT_SET_ERROR where useful. Other minor code formatting. 2016-12-17 20:47:42 +01:00
Werner Lemberg 2067c6985a [truetype] Disallow bitmap strokes for non-default instances.
Also speed up access of default instances if GX variations are
active.

* include/freetype/internal/tttypes.h (TT_FaceRec): Add
`is_default_instance' member.

* src/sfnt/sfobjs.c (sfnt_init_face): Initialize
`is_default_instance'.

* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Add test for default instance.
(TT_Load_Glyph): Load embedded bitmaps for default instance only.

* src/truetype/ttgxvar.c (TT_Set_MM_Blend): Compute
`is_default_instance'.
2016-09-29 19:49:07 +02:00
Werner Lemberg 2ecf89b481 */*: s/FT_MEM_ZERO/FT_ZERO/ where appropriate. 2016-09-28 19:06:21 +02:00
Werner Lemberg e27b8a5598 [truetype] Speed up `TT_Load_Glyph'.
This avoids additional calls to `tt_face_lookup_table' for the
`glyf' table, which can be expensive.

* include/freetype/internal/tttypes.h (TT_LoaderRec): Move
`glyf_offset' field to ...
(TT_FaceRec): ... this structure.
* src/truetype/ttgload.c (load_truetype_glyph): Updated.
(tt_loader_init): Move initialization of `glyf_offset' to ...
* src/truetype/ttpload.c (tt_face_load_loca): .. this function.
2016-09-27 21:21:01 +02:00
Werner Lemberg cf4224adb9 [truetype] Fix compiler warning.
* src/truetype/ttgload.c (load_truetype_glyph): Add cast.
2016-08-16 06:44:23 +02:00
Behdad Esfahbod 8183eeb18d [truetype] Fix GX variation handling of composites.
* src/truetype/ttgload.c (load_truetype_glyph)
[TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Check `ARGS_ARE_XY_VALUES' flag.
2016-08-06 23:12:55 +02:00
Werner Lemberg fae4ec0525 [sfnt, truetype] Don't abort on invalid `maxComponentDepth'.
Since 2016-05-16 we detect infinite recursion directly.

* src/sfnt/ttload.c (tt_face_load_maxp): Don't adjust
`maxComponentDepth'.
* src/truetype/ttgload.c (load_truetype_glyph): Don't abort if
`maxComponentDepth' is not valid.  Instead, simply adjust its value
and emit a tracing message.
2016-07-29 06:43:32 +02:00
Werner Lemberg 8ba407a7fe [truetype] Really fix deallocation in case of error (#47726).
* src/truetype/ttgload.c (load_truetype_glyph): Thinko; initialize
`outline.points' also.
2016-06-25 18:09:22 +02:00
Nikolaus Waxweiler 01de37e54f [truetype] Make TT_LOADER_SET_PP support subpixel hinting [3/3].
* src/truetype/ttgload.c (TT_LOADER_SET_PP): Replace macro with...
(tt_loader_set_pp): ... this new function.
Update all callers.
2016-05-18 07:07:44 +02:00
Nikolaus Waxweiler 596157365a [truetype] New implementation of v38 bytecode interpreter [1/3].
This patch prepares data structures and the like.

See added comments in `ttinterp.h' for more information on this and
the following commits in the series.

* devel/ftoption.h, include/freetype/config/ftoption.h
(TT_CONFIG_OPTION_SUBPIXEL_HINTING): Assign values to differentiate
between subpixel versions.
(TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY,
TT_SUPPORT_SUBPIXEL_HINTING_MINIMAL): New macros.

* include/freetype/ftttdrv.h (TT_INTERPRETER_VERSION_40): New macro.

* include/freetype/internal/tttypes.h (TT_FaceRec): Updated.

* src/truetype/ttinterp.h (TT_ExecContextRec): Define new fields
`subpixel_hinting_lean', `vertical_lcd_lean',
`backwards_compatibility', `iupx_called', iupy_called', and
`grayscale_cleartype' for new hinting mode.

* src/truetype/ttdriver.c (tt_property_set): Handle v38 and v40
interpreters conditionally.

* src/truetype/ttgload.c (TT_Hint_Glyph): Save phantom points unless
in v38 backwards compatibility mode.
Updated.
(compute_glyph_metrics): Add v38 backwards compatibility mode
constraint for adjusting advance widths.
Updated.
(tt_loader_init): Handle new flags `subpixel_hinting_lean',
`grayscale_cleartype', and `vertical_lcd_lean'.
Updated.
(tt_get_metrics, TT_Process_Simple_Glyph, TT_LOADER_SET_PP):
Updated.

* src/truetype/ttobjs.c (tt_driver_init): Conditionally set
default interpreter version number.

* src/truetype/ttsubpix.c, src/truetype/ttsubpix.h: Updated.
2016-05-18 06:57:59 +02:00
Werner Lemberg 533887a947 Whitespace, formatting. 2016-05-16 20:38:41 +02:00
suzuki toshiya a7d8bdbcfe [truetype] Improve the recursive reference detector.
The previous fix for #46372 misunderstood a composite glyph referring
same component twice as a recursive reference.  See the discussion

http://lists.gnu.org/archive/html/freetype/2016-05/msg00000.html

Thanks to Khaled Hosny for finding this issue.

* src/truetype/ttgload.c (ft_list_get_node_at): A function to get
the i-th node from FT_List.  (load_truetype_glyph): In the traversal
scan of the reference tree in the composite glyph, we clear the
nodes filled by previous sibling chain.
2016-05-16 21:57:26 +09:00
Werner Lemberg 432e00db2e [truetype] Fix deallocation in case of error (#47726).
* src/truetype/ttgload.c (load_truetype_glyph): Initialize fields in
`outline' that are going to be deallocated in case of error.
2016-04-24 08:14:07 +02:00
Werner Lemberg b663307320 * src/truetype/ttgload.c (TT_Load_Simple_Glyph): Minor.
This fixes an AddressSanitizer issue:

  ttgload.c:430:7: runtime error: null pointer passed as argument 1,
                   which is declared to never be null
2016-03-22 08:26:55 +01:00
Werner Lemberg 9adeab6452 Update copyright year. 2016-01-13 11:54:10 +01:00
Werner Lemberg 4679bf83a6 Fix C++ compilation.
* src/autofit/afloader.c: Include FT_INTERNAL_CALC_H.

* src/truetype/ttgload.c (load_truetype_glyph): Pacify compiler.
2015-11-28 19:05:36 +01:00
Werner Lemberg 837285e407 [truetype] Remove integer to pointer conversion compiler warning.
Problem reported by Alexei.

* src/truetype/ttgload.c (load_truetype_glyph): Use a solution found
in the glib library to fix the issue.
2015-11-09 09:20:08 +01:00
Werner Lemberg 758d55e522 [truetype] Catch infinite recursion in subglyphs (#46372).
* include/freetype/internal/tttypes.h (TT_LoaderRec): New field
`composites'.

* src/truetype/ttgload.c: Include FT_LIST_H.
(load_truetype_glyph): Add composite subglyph index to a list;
abort if index is already in list.
(tt_loader_init): Updated.
(tt_loader_done): New function.
(TT_Load_Glyph): Call `tt_loader_done'.
2015-11-04 11:44:47 +01:00
Werner Lemberg 040edaf5fb [truetype] Better tracing of composite glyphs.
* src/truetype/ttgload.c (TT_Load_Composite_Glyph,
load_truetype_glyph): Implement it.
2015-11-04 07:35:51 +01:00
Hin-Tak Leung 265ade8e80 Add new FT_LOAD_COMPUTE_METRICS load flag.
* include/freetype/freetype.h (FT_LOAD_COMPUTE_METRICS): New macro.
* src/truetype/ttgload.c (compute_glyph_metrics): Usage.
2015-09-26 14:51:30 +02:00
Werner Lemberg bd0438a461 Minor fixes for some clang warnings.
* src/base/ftoutln.c (FT_Outline_EmboldenXY): Cast, possible missing
initialization.

* src/truetype/ttgload.c (TT_Process_Composite_Component): Cast.
2015-09-16 18:05:43 +02:00
Alexei Podtelezhnikov ae258aa088 [truetype] Clean up.
* src/truetype/ttgload.c (TT_Process_Composite_Component): Use
`FT_Outline_Transform' and `FT_Outline_Translate'.
(translate_array): Dropped.
2015-08-14 23:23:18 -04:00
Alexei Podtelezhnikov 98e8e99986 [truetype] Clean up types.
* src/truetype/ttobjs.c (TT_Size): Move declaration from here.
* include/freetype/internal/tttypes.h (TT_Size): ... to here.
(TT_LoaderRec): Switch to appropriate types for `face' and `size'.
* src/truetype/ttgload.c: Remove corresponding type casts.
* src/truetype/ttsubpix.c: Ditto.
2015-08-06 00:06:14 -04:00
Werner Lemberg 8dfc760161 * src/truetype/ttgload.c (load_truetype_glyph)
[TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Fix crash for composite glyphs
having a depth greater than 1.
2015-08-03 12:23:30 +02:00
Werner Lemberg 6343ba22a3 Fix some bugs found by clang's `-fsanitize=undefined' (#45661).
* src/base/ftrfork.c (FT_Raccess_Get_HeaderInfo): Only accept
positive values from header.
Check overflow.

* src/base/ftoutln.c (SCALED): Correctly handle left-shift of
negative values.

* src/bdf/bdf.h (_bdf_glyph_modified, _bdf_set_glyph_modified,
_bdf_clear_glyph_modified): Use unsigned long constant.

* src/bdf/bdfdrivr.c (BDF_Size_Select, BDF_Glyph_Load): Don't
left-shift values that can be negative.

* src/pcf/pcfdrivr.c (PCF_Size_Select, PCF_Glyph_Load): Don't
left-shift values that can be negative.

* src/raster/ftraster.c (SCALED): Correctly handle left-shift of
negative values.

* src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Don't left-shift
values that can be negative.

* src/truetype/ttgload.c (TT_Load_Composite_Glyph,
compute_glyph_metrics, load_sbit_image): Don't left-shift values
that can be negative.
2015-08-01 07:53:48 +02:00
Werner Lemberg eb1bba9be4 Fix some clang compiler warnings.
* src/base/ftoutln.c (FT_Outline_EmboldenXY), src/cff/cf2intrp.c
(cf2_interpT2CharString), src/truetype/ttgload.c
(load_truetype_glyph), src/truetype/ttgxvar.c (tt_handle_deltas),
src/truetype/ttinterp.c (Ins_INSTCTRL): Fix signedness issues.
2015-06-30 09:46:39 +02:00
Werner Lemberg e9df4e47e3 [truetype] In GX, make private point numbers work correctly.
This is completely missing in Apple's documentation: If a `gvar'
tuple uses private point numbers (this is, deltas are specified for
some points only), the uncovered points must be interpolated for
this tuple similar to the IUP bytecode instruction.  Examples that
need this functionality are glyphs `Oslash' and `Q' in Skia.ttf.

* src/truetype/ttgxvar.c (tt_delta_shift, tt_delta_interpolate,
tt_handle_deltas): New functions.
(TT_Vary_Get_Glyph_Deltas): Renamed to...
(TT_Vary_Apply_Glyph_Deltas): ... this; it directly processes the
points and does no longer return an array of deltas.
Add tracing information.
Call `tt_handle_deltas' to interpolate missing deltas.
Also fix a minor memory leak in case of error.

* src/truetype/ttgxvar.h: Updated.

* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Updated.
2015-05-31 12:21:34 +02:00
Werner Lemberg a5e1f6f39b [truetype] Fix commit from 2015-05-22.
* src/truetype/ttgload.c, src/truetype/ttinterp.c: Guard new code
with `TT_CONFIG_OPTION_SUBPIXEL_HINTING'.

Problem reported by Nikolaus Waxweiler <madigens@gmail.com>.
2015-05-24 23:29:23 +02:00
Werner Lemberg 7f0994820b [truetype] Fix return values of GETINFO bytecode instruction.
* src/truetype/ttinterp.h (TT_ExecContextRec): New fields
`vertical_lcd' and `gray_cleartype'.

* src/truetype/ttgload.c (tt_loader_init): Initialize new fields.
Change `symmetrical smoothing' to TRUE, since FreeType produces
exactly this.

* src/truetype/ttinterp.c (Ins_GETINFO): Fix selector/return bit
values for symmetrical smoothing, namely 11/18.
Handle bits for vertical LCD subpixels (8/15) and Gray ClearType
(12/19).
2015-05-24 09:50:24 +02:00
Werner Lemberg bb435da213 [truetype] Minor.
* src/truetype/ttinterp.h (TT_ExecContext):
 s/subpixel/subpixel_hinting.

* src/truetype/ttgload.c, src/truetype/ttgload.h: Updated.
2015-05-23 07:21:25 +02:00
Werner Lemberg c61cad868b [truetype] Support selector index 3 of the INSTCTRL instruction.
This flag activates `native ClearType hinting', disabling backwards
compatibility mode as described in Greg Hitchcocks whitepaper.  In
other words, it enables unrestricted functionality of all TrueType
instructions in ClearType.

* src/truetype/ttgload.c (tt_get_metrics): Call `sph_set_tweaks'
unconditionally.
(tt_loader_init): Unset `ignore_x_mode' flag if bit 2 of
`GS.instruct_control' is active.

* src/truetype/ttinterp.c (Ins_INSTCTRL): Handle selector index 3.
(Ins_GETINFO): Updated.

* docs/CHANGES: Document it.
2015-05-22 22:02:15 +02:00