Commit Graph

990 Commits

Author SHA1 Message Date
Alexei Podtelezhnikov 4904d1eb1b * src/sfnt/ttpost.c (load_format_20): Micro-optimize. 2023-09-06 22:58:46 -04:00
Alexei Podtelezhnikov 000b26a30f * src/sfnt/ttpost.c (load_format_20): Rework tracing. 2023-08-30 23:03:02 -04:00
Alexei Podtelezhnikov 2f7abe4838 Comment added. 2023-08-29 19:18:43 +00:00
Alexei Podtelezhnikov c46c4b8e79 * src/sfnt/ttpost.c (load_format_20): Permit long names.
Fixes #1254.
2023-08-29 17:52:06 +00:00
Ben Wagner 3829fdaae5 Avoid overflow in COLR bounds checks.
The values read into `base_glyphs_offset_v1` and `layer_offset_v1` may
be in the range 0xFFFFFFFD-0xFFFFFFFF. On systems where `unsigned long`
is 32 bits adding 4 to such values will wrap and pass bounds checks but
accessing values at such offsets will be out of bounds.

On the other hand `table_size` has already been tested to be at least
`COLRV1_HEADER_SIZE` (34) so it is safe to subtract 4 from it.

* src/sfnt/ttcolr.c (tt_face_load_colr): subtract 4 from `table_size`
instead of adding 4 to font data offsets in bounds checks

Fixes: https://crbug.com/1469348
2023-08-04 11:41:23 -04:00
Ben Wagner dd3c9c5fec [woff2] Clean up on large brotli expansion
* src/sfnt/sfwoff2.c (woff2_open_font): set error and goto cleanup

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60711
2023-07-18 13:34:09 -04:00
Werner Lemberg 336503dfd7 [woff2] Avoid allocation bomb.
This is a fix for commit 85167dbd5, reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=60615

* src/sfnt/sfwoff2.c (MAX_SFNT_SIZE): New macro.
(woff2_open_font): Use it to limit the maximum size of an uncompressed WOFF2
font.
2023-07-16 07:40:32 +02:00
Ben Wagner 85167dbd50 [woff2] Remove sfnt size guess check
In WOFF the `totalSfntSize` must be correct, however in WOFF2 this value
is now just a hint and a conforming implementation must not reject
otherwise valid data if the `totalSfntSize` turns out not to be exact.

* src/sfnt/sfwoff2.c (woff2_open_font): remove check that uncompressed
woff2 data would fit in the sfnt size guess.

Fixes: #1235
2023-07-14 14:52:20 +00:00
Ben Wagner 2fb8eda5d6 */*: Remove many function pointer casts.
In C it is undefined behavior to call a function through a function pointer
of a different type.  This is now detected by the Control Flow Integrity
Sanitizer.  All known issues have already been fixed.  Prevent any
accidental re-introduction by removing function pointer casts when defining
services.  The services will call the service functions through the function
pointers on the service.  As a result the functions must have the same type
so there should be no need to cast.  Removing the casts allows compilers to
warn about assignment to an incompatible function pointer type.
2023-06-03 06:58:09 +02:00
Werner Lemberg 365eb10dd4 * src/sfnt/ttcmap: Signature fixes. 2023-05-07 19:16:38 +02:00
Werner Lemberg e245951c43 * src/sfnt/sfdriver.c, src/sfnt/ttbdf.c: Clean up interface.
Ensure that all driver functions use the signature of the service or driver.
This avoids pointer mismatches, which are technically undefined behaviour.
Recent compilers are more picky in catching them as part of Control Flow
Integrity tests.

* src/sfnt/sfdriver.c (sfnt_load_table): New wrapper function.
(sfnt_service_sfnt_table): Use it.
2023-05-07 14:59:50 +02:00
Werner Lemberg 8fe50c2adc [truetype] Fix style name handling for variation fonts.
* include/freetype/internal/tttypes.h (TT_FaceRec): New field
`non_var_style_name`.

* src/sfnt/sfobjs.c (sfnt_load_face): Initialize `non_var_style_name`.
(sfnt_done_face): Free `non_var_style_name`.

* src/truetype/ttgxvar.c (TT_Set_Named_Instance): Restore non-VF style name
if switching back to non-VF mode.
2023-05-06 18:53:50 +02:00
Werner Lemberg fb982e78a7 New Variation Font function `FT_Get_Default_Named_Instance`.
* include/freetype/ftmm.h, src/base/ftmm.c (FT_Get_Default_Named_Instance):
New function.

* include/freetype/internal/services/svmm.h
(FT_Get_Default_Named_Instance_Func): New typedef.
(FT_Service_MultiMasters): New field `get_default_named_instance`.
(FT_DEFINE_SERVICE_MULTIMASTERSREC): Updated.

* include/freetype/internal/tttypes.h (TT_Face): New field
`var_default_named_instance`.

* src/sfnt/sfobjc.s (sfnt_init_face): Initialize
`var_default_named_instance`.

* src/cff/cffdrivr.c (cff_get_default_named_instance): New function.
(cff_service_multi_masters): Updated.

* src/truetype/ttgxvar.c (TT_Get_MM_Var): Initialize
`var_default_named_instance`.
(TT_Get_Default_Named_Instance): New function.
* src/truetype/ttgxvar.h: Updated.
* src/truetype/ttdriver.c (tt_service_gx_multi_masters): Updated.

* src/type1/t1driver.c (t1_service_multi_masters): Updated.

* docs/CHANGES: Updated.
2023-05-06 18:53:50 +02:00
Alexei Podtelezhnikov 36a086b630 * src/sfnt/pngshim.c (Load_SBit_Png): Remove FALL_THROUGH warning. 2023-04-28 19:40:35 -04:00
Werner Lemberg 08268691aa * src/sfnt/ttload.c (tt_face_load_font_dir): Add another guard.
Reject 'OTTO' fonts with no valid tables.
2023-04-28 15:33:58 +02:00
Werner Lemberg 0a3836c97d Improve/add source comments and documentation. 2023-04-25 11:47:18 +02:00
Werner Lemberg 40676afc4c [sfnt] Fix handling of PS names for Variation Fonts.
* src/sfnt/sfdriver.c (get_win_string, get_apple_string): Continue
construction of string if an invalid character is encountered.

Fixes #1218.
2023-04-25 11:47:18 +02:00
Ben Wagner e78e2d29a9 [sfnt, truetype] Add `size_reset` to `MetricsVariations`.
This is a generalization of commit

```
commit e6699596af
Author: Werner Lemberg <wl@gnu.org>
Date:   Thu Feb 2 11:38:04 2017 +0100

    [truetype] Fix MVAR post-action handling.
```

It is also possible for plain `CFF ` style fonts to contain an `fvar` and
`MVAR` table and use `cff_metrics_adjust`.  `tt_size_reset` should only be
called with `TT_Size` and never with `CFF_Size`.

Allow the "metrics-variations" service to specify the correct function (if
any) to reset `FT_Size`s after adjusting metrics.

* src/truetype/ttobjs.c (tt_size_reset): Split off some functionality
into...
(tt_size_reset_height): ... this new function.

* src/truetype/ttdriver.c (tt_service_metrics_variations): Add
`size_reset`.
(tt_size_select, tt_size_request): Updated.

* src/truetype/ttobjs.h: Updated.

* include/freetype/internal/services/svmetric.h (MetricsVariations): Add
`size_reset`.
(FT_DEFINE_SERVICE_METRICSVARIATIONSREC): Updated.

* include/freetype/internal/tttypes.h (TT_FaceRec_): Rename `var` to
`tt_var` and add `face_var`.

* src/cff/cffdrivr.c (cff_service_metrics_variations): Add `size_reset`.
(cff_hadvance_adjust, cff_metrics_adjust): Updated.

* src/cff/cffobjs.c (cff_face_init): Use `face_var`.

* src/sfnt/sfobjs.c (sfnt_init_face): Initialize `face_var`.

* src/sfnt/ttmtx.c (tt_face_get_metrics): Use `tt_var`.

* src/truetype/ttgxvar.c (tt_size_reset_iterator): Renamed to...
(ft_size_reset_iterator): ... this new function.
Call `size_reset`.
(tt_apply_mvar): Pass `size_reset` to `ft_size_reset_iterator`.

Fixes #1211
2023-04-11 10:20:58 +02:00
Alexei Podtelezhnikov 1a4c18f7cb Align `char_next` return types.
This is mostly cosmetic because FT_UInt and FT_UInt32 are likely identical.

* src/sfnt/ttcmap.c, src/cff/cffcmap.c, src/psaux/t1cmap.c,
src/psnames/psmodule.c, include/freetype/internal/service/svpcsmap.h,
src/pfr/pfrcmap.c, src/winfonts/winfnt.c (*_char_next): return FT_UInt.
2023-04-10 15:30:43 +00:00
Alexei Podtelezhnikov d25444333c [sfnt] Clean up CMAP{4,12,13} handling.
This moves the charcode overflow checks upstream and turns some
while-loops into the do-while ones to avoid the uninitialized warnings.
This should slightly reduce the number of checks and jumps.

* src/sfnt/ttcmap.c (tt_cmap{4,12,13}_next,
tt_cmap{4.12.13}_char_map_linear): Remove the charcode overflow check.
(tt_cmap{4,12,13}_char_map_binary): Ditto and use do-while.
(tt_cmap{12,13}_char_next): Add the overflow check.
2023-04-08 23:15:41 -04:00
Alexei Podtelezhnikov b0a4f99278 * src/sfnt/ttpost.c (load_format_25): Do not abort frame reading. 2023-04-02 22:45:48 -04:00
Alexei Podtelezhnikov 340767bf85 * src/sfnt/ttpost.c (load_format_*): Streamline frame reading. 2023-04-02 22:00:59 -04:00
Alexei Podtelezhnikov 311b78fa12 * src/sfnt/ttpost.c: Formatting and comments. 2023-04-02 09:24:16 -04:00
Alexei Podtelezhnikov 8f7b145524 [sfnt] Consolidate POST version 2.0 and 2.5 (pt 2).
* src/sfnt/ttpost.c (load_format_20, load_format_25): Update arguments
and move shared calls and checks upstream to...
(load_post_names): ... this function.
(tt_face_free_ps_names, tt_face_get_ps_name): Updated.
2023-04-01 23:37:51 -04:00
Alexei Podtelezhnikov 9597a62bac [sfnt] Consolidate POST version 2.0 and 2.5 (pt 1).
The deprecated POST version 2.5 can be handled using the data
structures of version 2.0.  The goal is to reduce the footprint.

* include/freetype/internal/tttypes.h (TT_Post_Names): Absorb and...
(TT_Post_20, TT_Post_25): ... remove these structures.
src/sfnt/ttpost.c (load_post_names, tt_face_get_ps_name,
tt_face_free_ps_names, load_format_20): Updated accordingly.
(load_format_25): ditto and convert offsets to glyph indices.
2023-04-01 22:34:30 -04:00
Alexei Podtelezhnikov 6d7b8b22c4 [sfnt] Miscellaneous POST clean-ups.
* src/sfnt/ttpost.c (load_format_20): Decrease casts.
(load_format_25): Check the table length and impose a theoretical
glyph number limit usable with 8-bit offset.  Decrease casts.
(load_post_names): Pass the mapping data length without 2 bytes.
2023-03-31 23:17:46 -04:00
Alexei Podtelezhnikov 0db6997026 * src/sfnt/ttpost.c (load_format_20): Simplify comutations. 2023-03-30 09:06:35 -04:00
Alexei Podtelezhnikov 4679fcb666 [sfnt] Streamline POST format 2.0 handing (cont'd).
* src/sfnt/ttpost.c (load_format_20): Co-allocate the string data and
their pointers, which makes it easier to handle and free them.
(tt_face_free_ps_names): Updated.
* include/freetype/internal/tttypes.h (TT_Post_20): Update type.
2023-03-29 00:21:00 -04:00
Alexei Podtelezhnikov fc01e7dd67 Fix a couple of MSVC warnings.
* src/base/ftcalc.c (FT_MulAddFix): Add cast.
* src/sfnt/ttcolr.c (tt_face_get_colorline_stops, read_paint): Ditto.
2023-03-05 22:05:24 -05:00
Alexei Podtelezhnikov 7ae20e55c9 * src/sfnt/sfobjs.c (sfnt_load_face): Shorten de-referencing. 2023-03-03 22:41:09 -05:00
Werner Lemberg d399657f1b * src/*: Replace leading underscores with trailing ones in dummy variables.
This is to avoid clang warnings.
2023-02-26 20:18:54 +01:00
Werner Lemberg 663486a7ac Fix `FT_LOCAL` and `FT_LOCAL_DEF` tags. 2023-02-08 21:09:32 +01:00
Werner Lemberg ac5babe876 Fix 'fall-through' warning messages.
Modern compilers get more insistent on that...

* include/freetype/internal/compiler-macros.h (FALL_THROUGH): Define.
* src/*: Use it instead of `/* fall through */` comments.
2023-02-08 21:09:32 +01:00
Werner Lemberg da9eb9c719 Fix minor clang and clang++ warnings. 2023-02-08 19:57:22 +01:00
Werner Lemberg e97544a739 Minor changes.
Comment fixes, typos, removing of unnecessary parentheses.
2023-01-28 17:04:38 +01:00
Werner Lemberg bacc48e616 Whitespace. 2023-01-28 17:04:11 +01:00
Dominik Röttsches a297feab0e [sfnt] Avoid nullptr dereference in reading malformed 'COLR' v1 table.
Fixes https://bugs.chromium.org/p/chromium/issues/detail?id=1408044.

* src/sfnt/ttcolr.c (tt_face_load_colr): When the 'COLR' v1 table header is
too small, don't deallocate delta set index map structures.
2023-01-18 08:22:53 +01:00
Werner Lemberg 65f8523706 Update all copyright notices. 2023-01-17 09:18:25 +01:00
Werner Lemberg 6a179ff7d5 sr/*.c: Various minor fixes.
* src/autofit/ft-hb.c (_hb_ft_reference_table): Call `FT_UNUSED` after
variable declarations.

* src/gxvalid/gxvjust.c (gxv_just_widthDeltaClusters_validate): Eliminate
unused variable.

* src/gzip/ftgzip.c: Don't call GCC '-Wstrict-prototypes' pragma for C++
compiler.

* src/sfnt/ttcolr.c (ENSURE_READ_BYTES): Remove final semicolon to avoid
compiler warning.

* src/sfnt/ttsvg.c (tt_face_load_svg_doc): Fix signedness warning.
2023-01-16 16:38:56 +01:00
Dominik Röttsches 2692b3215b [sfnt] Remove temporary runtime flag for variable 'COLR' v1.
Fixes #1187.

* src/sfnt/ttcolr.c (top level, read_paint, tt_face_load_colr,
tt_face_free_colr, get_deltas_for_var_index_base,
tt_face_get_color_glyph_clipbox, tt_face_get_colorline_stops): Remove macro
definition `VARIABLE_COLRV1_ENABLED` and its usage.

* src/truetype/ttdriver.c (tt_property_set): Remove parsing of
'TEMPORARY-enable-variable-colrv1' property name.

* src/truetype/ttobjs.h (TT_DriverRec): Remove `enable_variable_colrv1`
flag.
2023-01-16 14:02:36 +01:00
Dominik Röttsches 63f371367a [sfnt] Fix color stop bounds check calculation at table end.
Fixes https://bugs.chromium.org/p/skia/issues/detail?id=14021

* src/sfnt/ttcolr.c (VAR_IDX_BASE_SIZE): New macro.
(tt_face_get_colorline_stops): Fix off-by-one bounds check calculation, take
`VarColorStop` into account, and hopefully make it easier to read.
2023-01-05 09:35:32 +01:00
Werner Lemberg 26e9028f10 [sdf, sfnt] Handle minor compiler warnings.
* src/sdf/ftsdf.c (get_min_distance_conic): Initialize `nearest_point`.

* src/sfnt/ttsvg.c (find_doc): Initialize `mid_doc`.

Fixes #1195.
2022-12-13 09:53:26 +01:00
Dominik Röttsches 0b62c1e43d [sfnt] Additional bounds checks for `COLR` v1 table handling.
* src/sfnt/ttcolr.c (read_paint): Add `colr` argument, necessary for...
... another use of `ENSURE_READ_BYTES`.
Update callers.
(tt_face_get_paint_layers): Ensure that the 4-byte paint table
offset can be read.

This is a follow-up to !124 and issue
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52404
2022-10-18 19:55:25 +02:00
Alexei Podtelezhnikov b8882a3ed6 * src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Simplify calculations. 2022-10-18 15:58:02 +00:00
Dominik Röttsches 04272824e0 [sfnt] Guard individual `COLR` v1 paint field reads.
* src/sfnt/ttcolr.c (ENSURE_READ_BYTES): New macro.
(read_paint): Use it – after the start pointer `p` has been checked for
whether it allows reading the format byte, each successive paint table field
read need to be bounds-checked before reading further values.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52404
2022-10-18 08:37:05 +02:00
Werner Lemberg 141d979af7 Minor comment changes. 2022-10-10 12:25:51 +02:00
Alexei Podtelezhnikov ff66e912d0 * src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Use lighter FT_DivFix. 2022-09-29 17:46:23 +00:00
Dominik Röttsches df2601395f [sfnt] Guard access in 'COLR' table when requesting child table pointer.
* src/sfnt/ttcolr.c (tt_face_get_colorline_stops, read_paint): Tighten
pointer bounds checks.
(get_child_table_pointer): Check whether incoming pointer `p` lies within
the 'COLR' table.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51816
2022-09-27 18:18:59 +02:00
Ben Wagner bd41700773 [sfnt] Add SVG document bounds checking.
Add a check that the document content is actually contained within the
`SVG ` table.  Without this check a malformed font may claim arbitrary
memory as its document content.

* src/sfnt/ttsvg.c (tt_face_load_svg): Take `numEntries` into account when
testing 'documentRecord' extents.
(find_doc): Rename `stream` to `document_records` for clarity.
(tt_face_load_svg_doc): Split `doc` from `doc_list` pointer for clarity.
Test that the document content is contained within the table.
Ensure minimum length of document before testing for gzip format.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51812
2022-09-27 07:31:32 +02:00
Dominik Röttsches 33ceac2afc Reject 'COLR' table if version is 1 but header too small.
* src/sfnt/ttcolr.c (tt_face_load_colr): If the version is determined to
be 1, then the table size has to be at least the size of the v1 header.
Also, for peeking the number of base glyphs and entries in the layer list,
ensure that the table is sufficiently long.

Fixes #1179.  Original patch by Sergey Temnikov.
2022-09-16 18:55:24 +02:00