From ce367774d20072018d46bfe26f7c7b823dfad79c Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Tue, 1 Aug 2017 08:24:51 +0200
Subject: [PATCH] [sfnt, truetype] Minor adjustments for OpenType 1.8.2.

* src/sfnt/sfobjs.c (sfnt_load_face): The units per EM value has now
(tighter) limits.

* src/truetype/ttgload.c (load_truetype_glyph): The new OpenType
version explicitly allows all negative values for the number of
contours if we have a composite glyph (this is for better backwards
compatibility I guess), but it still recommends value -1.
---
 ChangeLog              | 12 ++++++++++++
 src/sfnt/sfobjs.c      |  5 ++++-
 src/truetype/ttgload.c | 11 ++++-------
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 375975eae..7f50f7133 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2017-08-01  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt, truetype] Minor adjustments for OpenType 1.8.2.
+
+	* src/sfnt/sfobjs.c (sfnt_load_face): The units per EM value has now
+	(tighter) limits.
+
+	* src/truetype/ttgload.c (load_truetype_glyph): The new OpenType
+	version explicitly allows all negative values for the number of
+	contours if we have a composite glyph (this is for better backwards
+	compatibility I guess), but it still recommends value -1.
+
 2017-07-26  Werner Lemberg  <wl@gnu.org>
 
 	[cff] Integer overflow.
diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c
index 152690878..58f67c03e 100644
--- a/src/sfnt/sfobjs.c
+++ b/src/sfnt/sfobjs.c
@@ -1224,7 +1224,10 @@
         goto Exit;
     }
 
-    if ( face->header.Units_Per_EM == 0 )
+    /* OpenType 1.8.2 introduced limits to this value;    */
+    /* however, they make sense for older SFNT fonts also */
+    if ( face->header.Units_Per_EM <    16 ||
+         face->header.Units_Per_EM > 16384 )
     {
       error = FT_THROW( Invalid_Table );
 
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index d1351e795..086ebca52 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -1686,7 +1686,7 @@
     /***********************************************************************/
 
     /* otherwise, load a composite! */
-    else if ( loader->n_contours == -1 )
+    else if ( loader->n_contours < 0 )
     {
       FT_Memory  memory = face->root.memory;
 
@@ -1697,6 +1697,9 @@
       FT_ListNode  node, node2;
 
 
+      /* normalize the `n_contours' value */
+      loader->n_contours = -1;
+
       /*
        * We store the glyph index directly in the `node->data' pointer,
        * following the glib solution (cf. macro `GUINT_TO_POINTER') with a
@@ -1991,12 +1994,6 @@
         }
       }
     }
-    else
-    {
-      /* invalid composite count (negative but not -1) */
-      error = FT_THROW( Invalid_Outline );
-      goto Exit;
-    }
 
     /***********************************************************************/
     /***********************************************************************/