Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10317
* src/truetype/ttgxvar.c (ft_var_load_gvar): Properly exit memory
frame if we have invalid glyph variation data offsets.
(tt_face_vary_cvt): Protect against missing `tuplecoords' array.
Fix typo.
* src/truetype/ttgxvar.c (tt_set_mm_blend): Correctly set
`face->doblend' if the current call to the function yields the same
blend coordinates as the previous call.
It turned out that we incorrectly round CVT and glyph point deltas
before accumulation, leading to severe positioning errors if there
are many delta values to sum up.
Problem reported by Akiem Helmling <akiem@underware.nl> and analyzed
by Behdad.
* src/truetype/ttgxvar.c (ft_var_readpackeddelta): Return deltas in
16.16 format.
(tt_face_var_cvt): Collect deltas in `cvt_deltas', which is a 16.16
format array, and add the accumulated values to the CVT at the end
of the function.
(TT_Vary_Apply_Glyph_Deltas): Store data in `points_org' and
`points_out' in 16.16 format.
Collect deltas in `point_deltas_x' and `point_deltas_y', which are
16.16 format arrays, and add the accumulated values to the glyph
coordinates at the end of the function.
This monster commit was created by applying Nikhil's scripts
`docconverter.py' and `markify.py' to all C header and source files,
followed up by minor manual clean-up.
No change in functionality, of course.
I used commit f7419907bc6044b9b7057f9789866426c804ba82 from
https://github.com/nikramakrishnan/freetype-docs.git.
* src/truetype/ttgxvar.c (ft_var_to_normalized): Don't emit number
of coordinates.
(TT_Get_MM_Var): Trace instance indices names.
(TT_Set_Var_Design): Updated.
Behdad reported that setting blend coordinates, then getting design
coordinates did incorrectly return the default instance's
coordinates.
* src/truetype/ttgxvar.c (tt_set_mm_blend): Fix it.
We exit early if the current design or blend coordinates are
identical to the new ones.
* src/truetype/ttgxvar.c (tt_set_mm_blend, TT_Set_Var_Design):
Implement it, returning internal error code -1 if there will be no
variation change.
* src/type1/t1load.c (t1_set_mm_blend): Ditto.
* src/base/ftmm.c (FT_Set_Var_Design_Coordinates,
FT_Set_MM_Blend_Coordinates, FT_Set_Var_Blend_Coordinates): Updated.
* src/truetype/ttgload.c (TT_Process_Simple_Glyph): Always adjust
`pp1' to `pp4', except if we have an HVAR and/or VVAR table.
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Handle
alternative code branch identically w.r.t. presence of an HVAR
and/or VVAR table.
This commit completely separates the interaction between named
instances and variation functions. In particular, resetting the
variation returns to the current named instance (if set) and not to
the base font.
As a side effect, variation functions no longer change the named
instance index.
* src/cff/cffobjs.c (cff_face_init): Use MM service's `set_instance'
function.
Also apply `MVAR' table to named instances.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): Add cast.
(tt_set_mm_blend): No longer check whether requested variation
coincides with a named instance.
(TT_Set_Var_Design): Use current named instance for default
coordinates.
* src/truetype/ttobjs.c (tt_face_init): Use `TT_Set_Named_Instance'.
Without this change, clang's AddressSanitizer reports many runtime
errors due to misaligned addresses.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): Use multiples of pointer
size for sub-array offsets into `mmvar'.
The reserved `flags' field got a value in OpenType version 1.8.2;
unfortunately, the public `FT_Var_Axis' structure misses the
corresponding element. Since we can't add a new field, we add an
access function.
* src/base/ftmm.c (FT_Get_Var_Axis_Flags): New function.
* include/freetype/ftmm.h (FT_VAR_AXIS_FLAG_HIDDEN): New macro.
Updated.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): Increase allocated memory
of `mmvar' to hold axis flags.
Fill the axis flags array.
* docs/CHANGES: Updated.
Reported by Nikolaus Waxweiler <madigens@gmail.com>.
* src/truetype/ttgxvar.c (TT_Set_Var_Design): Correctly handle the
case where we have less input coordinates than axes.
* src/truetype/ttgxvar.c (tt_set_mm_blend): Compute all design
coordinates if we have to create the `blends->coord' array.
(TT_Get_MM_Blend, TT_Get_Var_Design): Select default instance
coordinates if no instance is selected yet.
When points are not touched by gvar interpolation deltas, FreeType
gave a slightly different result than Apple's CoreText.
The OpenType working group will update the specification to document
the following behaviour: If the two points with deltas to the `left'
and `right' of the untouched point have the same coordinate, then
the inferred delta for the untouched point should be zero.
* src/truetype/ttgxvar.c (tt_delta_interpolate): Implement new
behaviour.
Everything is guarded with TT_CONFIG_OPTION_GX_VAR_SUPPORT.
* include/freetype/internal/tttypes.h (TT_FaceRec): New fields
`var_postscript_prefix' and `var_postscript_prefix_len'.
* src/sfnt/sfdriver.c: Include FT_TRUETYPE_IDS_H.
(sfnt_is_alphanumeric): New wrapperfunction for `ft_isalnum'.
(get_win_string, get_apple_string): Remove `const' from return
value.
(MAX_VALUE_DESCRIPTOR_LEN, MAX_PS_NAME_LEN): New macros.
(hexdigits): New array.
(sfnt_get_var_ps_name): New function, implementing Adobe TechNote
5902 to construct a PS name for a variation font instance.
(sfnt_get_ps_name): Call `sfnt_get_var_ps_name' for font instances.
* src/sfnt/sfobjs.c (sfnt_done_face): Updated.
* src/truetype/ttgxvar.c (tt_set_mm_blend): Reset
`face->postscript_name' to trigger recalculation for new instance
parameters.
* include/freetype/internal/services/svmm.h (FT_Get_Var_Blend_Func):
Add `normalizedcoords' argument.
* src/truetype/ttgxvar.h (GX_BlendRec): Add `coords' field to store
the design coordinates of the current instance.
Updated.
* src/truetype/ttgxvar.c (TT_Set_MM_Blend): Move functionality to...
(tt_set_mm_blend): ... New function.
Convert data in `normalizedcoords' array to `coords' array on
demand.
(TT_Set_Var_Design): Store argument data in `coords' array.
(TT_Get_Var_Design): Get data from `coords' array.
(tt_get_var_blend): Updated.
(tt_done_blend): Updated.
* src/cff/cffload.c, src/cff/cffload.h (cff_get_var_blend): Updated.
* src/cff/cf2ft.c (cf2_getNormalizedVector): Updated.
* src/cff/cffobjs.c (cff_face_init): Updated.
As documented in the OpenType specification, an entry for the
default instance may be omitted in the named instance table. In
particular this means that even if there is no named instance table
in the font we actually do have a named instance, namely the default
instance.
For consistency, we always want the default instance in our list of
named instances. If it is missing, we try to synthesize it.
* src/sfnt/sfobjs.c (sfnt_init_face): Check whether the default
instance is in the table of named instances. Otherwise adjust
number of instances.
* src/truetype/ttgxvar.c: Include FT_TRUETYPE_IDS_H.
(TT_Get_MM_Var): Use `face->root.style_flags' as the number of named
instances.
Sythesize a named instance entry if necessary.
(tt_done_blend): Free `normalized_stylecoords'.
* src/truetype/ttgxvar.h (GX_HVarTable): Renamed to...
(GX_HVVarTable): ...This.
(GX_Blend): Add fields for `VVAR' table handling.
Other minor updates.
* src/truetype/ttgxvar.c (ft_var_load_hvar): Renamed to...
(ft_var_load_hvvar): ...This.
Handle VVAR loading also (controlled by an additional parameter).
(tt_hadvance_adjust): Renamed to...
(tt_hvadvance_adjust): ...This.
Handle application of advance height also (controlled by an
additional parameter).
(tt_hadvance_adjust, tt_vadvance_adjust): Wrappers for
`tt_hvadvance_adjust'.
* src/truetype/ttdriver.c (tt_service_metrics_variations): Updated.
* src/truetype/ttgxvar.h (GX_MVarTable): `axisCount' has been
removed frem the specification; it is now reserved.
* src/truetype/ttgxvar.c (ft_var_load_mvar): Updated.
(GX_FVar_Head): Remove `countSizePairs'; the corresponding data
field in the `MVAR' table is now reserved.
(fvar_fields): Updated.
* src/truetype/ttgxvar.h (MVAR_TAG_XXX): New macros for MVAR tags.
(GX_Value, GX_MVarTable): New structures.
(GX_Blend): Add it.
* src/truetype/ttgxvar.c (GX_VALUE_SIZE, GX_VALUE_CASE,
GX_GASP_CASE): New macros.
(ft_var_get_value_pointer): New auxiliary function to get a pointer
to a value from various SFNT tables already stored in `TT_Face'.
(ft_var_load_mvar): New function.
(TT_Get_MM_Var): Call it.
(tt_done_blend): Updated.
We need this later on for MVAR also.
* src/truetype/ttgxvar.c (tt_hadvance_adjust): Split off computing
an item store variation delta into...
(ft_var_get_item_delta): ...new function.
We need this later on for MVAR also.
* src/truetype/ttgxvar.c (tt_done_blend): Split off handling of item
variation store into...
(ft_var_done_item_variation_store): ...new function.
We need this later on for MVAR also.
* src/truetype/ttgxvar.c (ft_var_load_delta_set_index_mapping): Add
parameters for delta-set index mapping and item variation store.
(ft_var_load_item_variation_store): Add parameter for item variation
store.
s/hvarData/varData/.
Move allocation of `hvar_table' to...
(ft_var_load_hvar): ...this function.
Updated.
* src/truetype/ttgxvar.c (): Split off loading of item variation
store and delta set index mapping into...
(ft_var_load_item_variation_store,
ft_var_load_delta_set_index_mapping): ... new functions.
* src/truetype/ttgxvar.c (ft_var_load_hvar): Handle case where
`offsetToAdvanceWidthMapping' is zero.
(tt_hadvance_adjust): Implement direct deltaSet access by glyph
index.
* src/cff/cffload.c (FT_fdot14ToFixed): Fix casting.
(cff_blend_doBlend): Don't left-shift negative numbers.
Handle 5-byte numbers byte by byte to avoid alignment issues.
* src/cff/cffparse.c (cff_parse): Handle 5-byte numbers byte by byte
to avoid alignment issues.
* src/cid/cidload (cid_read_subrs): Do nothing if we don't have any
subrs.
* src/psaux/t1decode.c (t1_decode_parse_charstring): Fix tracing.
* src/tools/glnames.py (main): Put `DEFINE_PSTABLES' guard around
definition of `ft_get_adobe_glyph_index'.
* src/psnames/pstables.h: Regenerated.
* src/psnames/psmodule.c: Inlude `pstables.h' twice to get both
declaration and definition.
* src/truetype/ttgxvar.c (FT_fdot14ToFixed, FT_intToFixed): Fix
casting.
Make some functions work before a call to `TT_Set_MM_Blend'.
* src/truetype/ttgxvar.c (tt_hadvance_adjust): Exit immediately if
we don't blend.
(TT_Get_MM_Blend, TT_Get_Var_Design): Return default values if we
don't blend.
* include/freetype/internal/tttypes.h (TT_FACE_FLAG_VAR_XXX):
New macros describing available functionality of various OpenType
tables related to font variation.
(TT_Face): New fields `variation_support' and `mvar_support',
replacing and extending `use_fvar'.
* src/sfnt/sfobjs.c (sfnt_init_face, sfnt_load_face): Use
`variation_support'.
* src/truetype/ttgxvar.c (ft_var_load_hvar): Set `variation_support'
field.
(TT_Vary_Apply_Glyph_Deltas): Updated.
In particular, we need access to named instance data.
* include/freetype/internal/services/svmm.h (FT_Get_Var_Blend_Func):
Add argument for `FT_MM_Var'.
* src/cff/cffload.c (cff_get_var_blend): Updated.
* src/cff/cffload.h: Updated.
* src/cff/cf2ft.c (cf2_getNormalizedVector): Updated.
* src/truetype/ttgxvar.c (tt_get_var_blend): Updated.
Accept value `NULL' for arguments.
* src/truetype/ttgxvar.h: Updated.
This is better behaviour than exiting with an error.
* include/freetype/internal/tttypes.h (TT_Face): Add `use_fvar'
field.
* src/sfnt/sfobjs.c (sfnt_init_face): Compute `use_fvar', also
updating the validation code.
Use `use_fvar' to compute FT_FACE_FLAG_MULTIPLE_MASTERS.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): Remove `fvar' validation
code.
* src/sfnt/sfobjs.c (sfnt_init_face): If the axis count in `fvar' is
zero, set `num_instances' to zero.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): Handle `fvar' table with
zero axes as invalid.
* src/truetype/ttobjs.c (tt_face_init): Improve logic of loading
`loca', `cvt', `fpgm', and `prep' table.
* src/cff/cf2font.h: Include `cffload.h'.
* src/cff/cffload.c: Include FT_MULTIPLE_MASTERS_H and
FT_SERVICE_MULTIPLE_MASTERS_H.
(cff_vstore_load): Eliminate `vsSize'.
(cff_load_private_dict): Tag as `FT_LOCAL_DEF'.
* src/cff/cffload.h: Include `cffobjs.h'.
Provide declaration for `cff_load_private_dict'.
* src/truetype/ttgxvar.c (ft_var_load_hvar): Eliminate
`minorVersion' and `map_offset'.
The font variation code. All parts dependent on the GX code in the
`truetype' module are guarded with TT_CONFIG_OPTION_GX_VAR_SUPPORT.
In other words, you can still compile the `cff' module without
defining TT_CONFIG_OPTION_GX_VAR_SUPPORT (which brings you CFF2
support without font variation).
* src/cff/cf2font.c (cf2_font_setup): Add support for font
variation.
* src/cff/cf2font.h (CF2_Font): Add fields for variation data.
* src/cff/cf2ft.c (cf2_free_instance): Free blend data.
(cf2_getVStore, cf2_getNormalizedVector): New functions.
* src/cff/cf2ft.h: Updated.
* src/cff/cf2intrp.c: Include `cffload.h'.
(cf2_cmdRESERVED_15, cf2_cmdRESERVED_16): Replace with...
(cf2_cmdVSINDEX, cf2_cmdBLEND): ... this new enum values.
(cf2_doBlend): New function.
(cf2_interpT2CharString): Handle `vsindex' and `blend' opcodes.
* src/cff/cffload.c (FT_fdot14ToFixed): New macro.
(cff_vstore_done, cff_vstore_load): New functions.
(cff_blend_clear, cff_blend_doBlend, cff_blend_build_vector,
cff_blend_check_vector): New functions.
(cff_load_private_dict): Add arguments for blend vector.
Handle blend data.
(cff_subfont_load, cff_subfont_done): Updated.
(cff_font_load): Handle CFF2 variation store data.
(cff_font_done): Updated.
* src/cff/cffload.h: Include `cffparse.h'.
Updated.
* src/cff/cffobjs.c (cff_face_done): Updated.
* src/cff/cffparse.c: Include `cffload.h'.
(cff_parse_num): Handle internal value 255.
(cff_parse_vsindex, cff_parse_blend): New functions.
(CFF_FIELD_BLEND): New macro.
(cff_parser_run): Updated.
* src/cff/cffparse.h (cff_kind_blend): New enum value.
* src/cff/cfftoken.h: Handle `vstore', `vsindex', and `blend'
dictionary values.
* src/cff/cfftypes.h (CFF_VarData, CFF_AxisCoords, CFF_VarRegion,
CFF_VStore, CFF_Blend): New structures.
(CFF_FontRecDict): Add `vstore_offset' field.
(CFF_Private): Add `vsindex' field.
(CFF_SubFont): Add fields for blend data.
(CFF_Font): Add `vstore' field.
* src/truetype/ttgxvar.c (TT_Get_MM_Var): `CFF2' is equal to `gvar',
since glyph variation data is directly embedded.
(TT_Set_MM_Blend): Don't load `gvar' table for CFF2 fonts.
Note that this is not complete yet; it only handles advance width
variation.
Activation of the code follows in another commit.
* include/freetype/ftmm.h (FT_Var_Named_Style): Add `psid' member.
* src/truetype/ttgxvar.h (GX_HVarData, GX_AxisCoords, GX_HVarRegion,
GX_HVStore, GX_WidthMap): New auxiliary structures for...
(GX_HVarTable): ... HVAR main structure.
(GX_BlendRec): Add data for HVAR loading.
* src/truetype/ttgxvar.c (FT_FIXED_ONE, FT_fdot14ToFixed,
FT_intToFixed, FT_fixedToInt): New macros.
(ft_var_load_hvar): New function.
(TT_Get_MM_Var): Updated.
(tt_done_blend): Deallocate HVAR data.
For internal use; we want to share code between the forthcoming CFF2
support and TrueType.
* include/freetype/internal/services/svmm.h (FT_Get_Var_Blend_Func):
New typedef.
(MultiMasters): Add `get_var_blend'.
(FT_Service_MultiMasters): Updated.
* src/truetype/ttgxvar.c (tt_get_var_blend): New function.
* src/truetype/ttgxvar.h: Updated.
* src/truetype/ttdriver.c (tt_service_gx_multi_masters): Updated.
* src/type1/t1driver.c (t1_service_multi_masters): Updated.
For internal use; we want to share code between the forthcoming CFF2
support and TrueType.
* include/freetype/internal/services/svmm.h (FT_Done_Blend_Func):
New typedef.
(MultiMasters): Add `done_blend'.
(FT_Service_MultiMasters): Updated.
* src/truetype/ttgxvar.c (tt_done_blend): Use `TT_Face' as argument.
* src/truetype/ttgxvar.h: Updated.
* src/truetype/ttobjs.c (TT_Face_Done): Updated.
* src/truetype/ttdriver.c (tt_service_gx_multi_masters): Updated.
* src/type1/t1driver.c (t1_service_multi_masters): Updated.
Note that the low-level functions aren't implemented yet.
* include/freetype/ftmm.h: Declare.
* include/freetype/internal/services/svmm.h
(FT_Get_Var_Design_Func): New typedef.
(MultiMasters): New MM service function `get_var_design'.
(FT_DEFINE_SERVICE_MULTIMASTERSREC): Updated.
Update all callers.
* src/base/ftmm.c (FT_Get_Var_Design_Coordinates): Implement.
* src/truetype/ttdriver.c: Updated.
* src/truetype/ttgxvar.c (TT_Get_Var_Design): New dummy function to
handle `get_var_design' service.
* src/truetype/ttgxvar.h: Updated.
* src/type1/t1driver.c: Updated.
* src/type1/t1load.c (T1_Get_Var_Design): New dummp function to
handle `get_var_design' service.
* src/type1/t1load.h: Updated.
This is required by OpenType 1.8; it also avoids rounding surprises.
* src/truetype/ttgxvar.c (TT_Set_Var_Design): Clamp design coordinates
outside of the allowed range to always stay within the range instead
of producing an error.
Alexei Podtelezhnikov