Commit Graph

17 Commits

Author SHA1 Message Date
Werner Lemberg addb2dddb6 [base, cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2060
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2062
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2063
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2068

* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.

* src/cff/cf2blues.c (cf2_blues_capture), src/cff/cf2hints.c
(cf2_hintmap_adjustHints): Use OVERFLOW_SUB_INT32.

* src/truetype/ttgload.c (compute_glyph_metrics): User
OVERFLOW_SUB_LONG.

* src/truetype/ttinterp.c (Direct_Move, Direct_Move_Orig,
Direct_Move_X, Direct_Move_Y, Direct_Move_Orig_X,
Direct_Move_Orig_Y, Move_Zp2_Point, Ins_MSIRP): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.
2017-06-03 21:05:42 +02:00
Werner Lemberg 1ea343228d [cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2047
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2057

* src/cff/cf2hints.c (cf2_hintmap_map): Use OVERFLOW_SUB_INT32.

* src/truetype/ttinterp.c (Ins_ADD): Use OVERFLOW_ADD_LONG.
(Ins_SUB): Use OVERFLOW_SUB_LONG.
(Ins_NEG): Use NEG_LONG.
2017-06-03 06:52:13 +02:00
Werner Lemberg 3802ca8b64 [cff] Fix integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2027
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2028

* src/cff/cf2hints.c (cf2_hintmap_insertHint), src/cff/cf2intrp.c
(cf2_doFlex): Use OVERFLOW_ADD_INT32 and OVERFLOW_SUB_INT32.
2017-06-02 08:44:20 +02:00
Werner Lemberg e66d7300fe [cff] 32bit integer overflow run-time errors 2/2 (#46149).
This commit handles the new engine.

* include/freetype/internal/ftcalc.h (OVERFLOW_ADD_INT32,
OVERFLOW_SUB_INT32, OVERFLOW_MUL_INT32, NEG_INT, NEG_LONG,
NEG_INT32): New macros.

* src/cff/cf2ft.c (cf2_getScaleAndHintFlag): Use OVERFLOW_ADD_INT32.

* src/cff/cf2hints.c (cf2_getWindingMomentum, cf2_hint_init,
cf2_hintmap_map, cf2_glyphpath_hintPoint,
cf2_glyphpath_computeIntersection, cf2_glyphpath_computeOffset,
cf2_glyphpath_lineTo, cf2_glyphpath_curveTo): Use
OVERFLOW_ADD_INT32, OVERFLOW_SUB_INT32, OVERFLOW_MUL_INT32, and
NEG_INT32 where appropriate.

* src/cff/cf2intrp.c (cf2_doFlex, cf2_doBlend,
cf2_interpT2CharString): Ditto.
Also add some other code where needed to avoid overflow.
2017-05-31 16:16:50 +02:00
Werner Lemberg 2e4188d833 [cff] s/cf2_floatToFixed/cf2_doubleToFixed/.
The new name better describes what the macro actually does;
additionally, we don't need a trailing `f' for literals (there was
only a single such instance in the code, but this caused a clang
warning because the macro itself uses `double' literals).

* src/cff/cf2blues.c, src/cff/cf2blues.h, src/cff/cf2fixed.h,
src/cff/cf2font.c, src/cff/cf2hints.c: Updated.
2017-05-28 07:46:22 +02:00
Werner Lemberg 37c72f66a5 Minor formatting. 2016-12-25 22:55:25 +01:00
Dave Arnold 748e368173 [cff] Remove an assert (#46107).
* src/cff/cf2hints.c (cf2_hintmap_insertHint): Ignore paired edges
in wrong order.
2015-10-21 13:58:43 +02:00
Werner Lemberg eb05bfbe09 [cff] Signedness fixes for new engine.
* src/cff/cf2arrst.c, src/cff/cf2fixed.h, src/cff/cf2ft.c,
src/cff/cf2ft.h, src/cff/cf2hints.c, src/cff/cf2intrp.c: Apply.
2015-02-20 08:37:35 +01:00
Dave Arnold f89396cb62 [cff] Modify an FT_ASSERT.
* src/cff/cf2hints.c (cf2_hintmap_map): After the fix for Savannah
bug #43661, the test font `...aspartam.otf' still triggers an
FT_ASSERT.  Since hintmap still works with count==0, ...
(cf2_glyphpath_lineTo, cf2_glyphpath_curveTo): ... add that term to
suppress the assert.
2014-12-04 06:17:26 +01:00
Dave Arnold 2cdc4562f8 [cff] Fix Savannah bug #43661.
* src/cff/cf2intrp.c (cf2_interpT2CharString) <cf2_cmdHSTEM,
cf2_cmdVSTEM, cf2_cmdHINTMASK>: Don't append to stem arrays after
hintmask is constructed.

* src/cff/cf2hints.c (cf2_hintmap_build): Add defensive code to
avoid reading past end of hintmask.
2014-12-04 06:10:16 +01:00
Werner Lemberg d17cabf57d [cff] Fix typo.
* src/cff/cf2hints.c (cf2_glyphpath_computeOffset): Use correct
offsets in third quadrant.

Reported by maks <maksqwe1@ukr.net>.
2014-07-26 09:53:50 +09:00
Alexei Podtelezhnikov 6adda68a75 Math simplifications.
* src/cf2blues.c (cf2_blues_init): Use `FT_MulDiv'.
* src/cf2ft.c (cf2_getScaleAndHintFlag): Use simple division.
2014-02-28 09:25:57 +01:00
Dave Arnold 0eae6eb064 Fix Savannah bug #41697, part 1.
* src/cff/cf2hints.c (cf2_hintmap_build): Return when `hintMask' is
invalid.  In this case, it is not safe to use the length of
`hStemHintArray'; the exception has already been recorded in
`hintMask'.
2014-02-28 07:45:07 +01:00
Dave Arnold dd21301ef2 [cff] Fix for hints that touch.
* src/cff/cf2hints.c (cf2_hintmap_insertHint): Fix condition for
finding index value of insertion point.
2013-11-08 10:52:51 +01:00
Dave Arnold 3a2cb0f881 Fix Savannah bug #39295.
The bug was caused by switching to the initial hintmap (the one in
effect when `moveto' executes) just before drawing the final element
in the charstring.  This ensured that the path was closed (in both
Character Space and Device Space).  But if the final element was a
curve and if the final hintmap was different enough from the initial
one, then the curve was visibly distorted.

The first part of the fix is to draw the final curve using the final
hintmap as specified by the charstring.  This corrects the
distortion but does not ensure closing in Device Space.  It may
require the rasterizer to automatically generate an extra closing
line.  Depending on the hintmap differences, this line could be from
zero to a couple pixels in length.

The second part of the fix covers the case where the charstring
subpath is closed with an explicit line.  We now modify that line's
end point to avoid the distortion.

Some glyphs in the bug report font (TexGyreHeros-Regular) that show
the change are:

  25ppem    S (98)
  24ppem    eight (52)
  25.5ppem  p (85)

Curves at the *end* of a subpath are no longer distorted.  However,
some of these glyphs have bad hint substitutions in the middle of a
subpath, and these are not affected.

The patch has been tested with a set of 106 fonts that shipped with
Adobe Creative Suite 4, together with 756 Open Source CFF fonts from
Google Fonts.  There are 1.5 million glyphs, of which some 20k are
changed with the fix.  A sampling of a few hundred of these changes
have been examined more closely, and the changes look good (or at
least acceptable).

* src/cff/cf2hints.h (CF2_GlyphPathRec): New element `pathIsClosing'
to indicate that we synthesize a closepath line.

* src/cff/cf2hints.c (cf2_glyphpath_init): Updated.
(cf2_glyphpath_pushPrevElem): If closing, use first hint map (for
`lineto' operator) and adjust hint zone.
For synthesized closing lines, use end point in first hint zone.
(cf2_glyphpath_lineTo): Take care of synthesized closing lines.  In
particular, shift the detection of zero-length lines from character
space to device space.
(cf2_glyphpath_closeOpenPath): Remove assertion.
Updated.
2013-09-29 16:17:02 +02:00
Werner Lemberg c06889eb2c More compiler warning fixes.
*/*: Use cast to `FT_Bool' (or `Bool') where appropriate.
2013-06-12 10:58:06 +02:00
Werner Lemberg 283c8ed817 [cff] New files for Adobe's Type 2 interpreter and hinting engine. 2013-04-13 15:02:31 +02:00