From d8ea52dee53defec67cbea8f467f1ad1e971ba25 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Tue, 24 Jul 2018 23:03:06 +0200
Subject: [PATCH] [type1] Check relationship between number of axes and
 designs.

For Multiple Masters fonts We don't support intermediate designs;
this implies that

  number_of_designs == 2 ^^ number_of_axes

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9557

* src/type1/t1load.c (T1_Open_Face): Ensure above constraint.
(T1_Get_MM_Var): Remove now redundant test.
---
 ChangeLog          | 16 ++++++++++++++++
 src/type1/t1load.c | 25 ++++++++++++++++---------
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 7f450b857..bdfb41c5e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,19 @@
+2018-07-24  Werner Lemberg  <wl@gnu.org>
+
+	[type1] Check relationship between number of axes and designs.
+
+	For Multiple Masters fonts We don't support intermediate designs;
+	this implies that
+
+	  number_of_designs == 2 ^^ number_of_axes
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9557
+
+	* src/type1/t1load.c (T1_Open_Face): Ensure above constraint.
+	(T1_Get_MM_Var): Remove now redundant test.
+
 2018-07-24  Hin-Tak Leung  <htl10@users.sourceforge.net>
 
 	[truetype] Match ttdebug's naming of instruction mnemonics.
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 8bcf2eaa2..a20d1782c 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -348,16 +348,13 @@
         mmvar->axis[i].tag = FT_MAKE_TAG( 'o', 'p', 's', 'z' );
     }
 
-    if ( blend->num_designs == ( 1U << blend->num_axis ) )
-    {
-      mm_weights_unmap( blend->default_weight_vector,
-                        axiscoords,
-                        blend->num_axis );
+    mm_weights_unmap( blend->default_weight_vector,
+                      axiscoords,
+                      blend->num_axis );
 
-      for ( i = 0; i < mmaster.num_axis; i++ )
-        mmvar->axis[i].def = mm_axis_unmap( &blend->design_map[i],
-                                            axiscoords[i] );
-    }
+    for ( i = 0; i < mmaster.num_axis; i++ )
+      mmvar->axis[i].def = mm_axis_unmap( &blend->design_map[i],
+                                          axiscoords[i] );
 
     *master = mmvar;
 
@@ -2356,6 +2353,16 @@
 
 #ifndef T1_CONFIG_OPTION_NO_MM_SUPPORT
 
+    /* we don't support Multiple Master fonts with intermediate designs; */
+    /* this implies that `num_designs' must be equal to `2^^num_axis'    */
+    if ( face->blend                                                 &&
+         face->blend->num_designs != ( 1U << face->blend->num_axis ) )
+    {
+      FT_ERROR(( "T1_Open_Face:"
+                 " number-of-designs != 2 ^^ number-of-axes\n" ));
+      T1_Done_Blend( face );
+    }
+
     if ( face->blend                                                     &&
          face->blend->num_default_design_vector != 0                     &&
          face->blend->num_default_design_vector != face->blend->num_axis )