Commit Graph

6070 Commits

Author SHA1 Message Date
Werner Lemberg 9038837ee2 [cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2144
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2151
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2153
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2173
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2186

* src/cff/cf2blues.c (cf2_blues_init): Use SUB_INT32.

* src/truetype/ttinterp.c (Round_None, Round_To_Grid,
Round_To_Half_Grid, Round_Down_To_Grid, Round_Up_To_Grid,
Round_To_Double_Grid, Round_Super, Round_Super_45): Use ADD_LONG,
SUB_LONG, NEG_LONG, FT_PIX_ROUND_LONG, FT_PIX_CEIL_LONG,
FT_PAD_ROUND_LONG
(Ins_SxVTL, Ins_MIRP): Use SUB_LONG.
(_iup_worker_shift): Use SUB_LONG and ADD_LONG.
2017-06-09 20:42:46 +02:00
Werner Lemberg 96d26926d1 Provide more macros for flooring, ceiling, and rounding.
These versions don't produce run-time errors due to integer
overflow.

* include/freetype/internal/ftobjs.h: Include FT_INTERNAL_CALC_H.
(FT_PAD_ROUND_LONG, FT_PAD_CEIL_LONG, FT_PIX_ROUND_LONG,
FT_PIX_CEIL_LONG): New macros.
(FT_PAD_ROUND_INT32, FT_PAD_CEIL_INT32, FT_PIX_ROUND_INT32,
FT_PIX_CEIL_INT32): New macros.
2017-06-09 20:34:28 +02:00
Werner Lemberg faf34d29e2 Remove unused macros.
* include/freetype/internal/ftcalc.h (ADD_INT, SUB_INT, MUL_INT,
NEG_INT): Deleted.
2017-06-09 20:31:24 +02:00
Werner Lemberg dcd8de272f */*: Remove `OVERFLOW_' prefix.
This increases readability.
2017-06-09 11:21:58 +02:00
Werner Lemberg 7bffeacd7e [cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137

* src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.

* src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
OVERFLOW_SUB_LONG.
2017-06-07 17:08:01 +02:00
Werner Lemberg 24848a3d58 [cff] Integer overflow.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2109
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2110
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2122

* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.

* src/cff/cf2hints.c (cf2_hintmap_map): Synchronize if-else
branches.
2017-06-06 12:05:04 +02:00
Werner Lemberg 8667042997 [cff] Integer overflow.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2089

* src/cff/cffload.c (cff_blend_doBlend): User OVERFLOW_ADD_INT32.
2017-06-05 06:20:53 +02:00
Werner Lemberg 9fa8a2997f [cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2075
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2088

* src/cff/cf2font.c (cf2_font_setup): Use OVERFLOW_MUL_INT32.

* src/truetype/ttinterp.c (Ins_ISECT): Use OVERFLOW_MUL_LONG,
OVERFLOW_ADD_LONG, and OVERFLOW_SUB_LONG.
2017-06-04 20:43:08 +02:00
Werner Lemberg addb2dddb6 [base, cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2060
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2062
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2063
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2068

* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.

* src/cff/cf2blues.c (cf2_blues_capture), src/cff/cf2hints.c
(cf2_hintmap_adjustHints): Use OVERFLOW_SUB_INT32.

* src/truetype/ttgload.c (compute_glyph_metrics): User
OVERFLOW_SUB_LONG.

* src/truetype/ttinterp.c (Direct_Move, Direct_Move_Orig,
Direct_Move_X, Direct_Move_Y, Direct_Move_Orig_X,
Direct_Move_Orig_Y, Move_Zp2_Point, Ins_MSIRP): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.
2017-06-03 21:05:42 +02:00
Werner Lemberg c9a9cf5915 * builds/unix/freetype-config.in: Fix pkg-config test (#51162).
Patch directly taken from bug report.
2017-06-03 09:41:50 +02:00
Werner Lemberg 2c2e6403b7 [bdf] Synchronize sanity checks with pcf driver.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2054
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2058

* src/bdf/bdfdrivr.c (BDF_Face_Init): Check font ascent and descent.
Check AVERAGE_WIDTH, POINT_SIZE, PIXEL_SIZE, RESOLUTION_X, and
RESOLUTION_Y properties.
2017-06-03 07:38:11 +02:00
Werner Lemberg 1ea343228d [cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2047
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2057

* src/cff/cf2hints.c (cf2_hintmap_map): Use OVERFLOW_SUB_INT32.

* src/truetype/ttinterp.c (Ins_ADD): Use OVERFLOW_ADD_LONG.
(Ins_SUB): Use OVERFLOW_SUB_LONG.
(Ins_NEG): Use NEG_LONG.
2017-06-03 06:52:13 +02:00
Werner Lemberg c5a225413f ftcalc.h: Avoid left-shift of negative numbers.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2055

* include/freetype/internal/ftcalc.h (INT_TO_F26DOT6,
INT_TO_F2DOT14, INT_TO_FIXED, F2DOT14_TO_FIXED): Use multiplication.
2017-06-03 06:13:10 +02:00
Werner Lemberg 0716c6ab7a [cff] Even more integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2046

* src/cff/cf2intrp.c (cf2_doStems, cf2_interpT2CharString): Use
OVERFLOW_ADD_INT32.
2017-06-02 19:24:03 +02:00
Werner Lemberg 7a4276fb90 [cff] More integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032

* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
2017-06-02 09:21:37 +02:00
Werner Lemberg 03b0cc2ea9 [bdf] Don't left-shift negative numbers.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2031

* src/bdf/bdfdrivr.c (BDF_Face_Init): Use multiplication.
2017-06-02 09:16:52 +02:00
Werner Lemberg 47a03e9b23 [bdf] Fix integer scanning routines.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2029

* src/bdf/bdflib.c (_bdf_atoul, _bdf_atol, _bdf_atous, _bdf_atos):
Stop scanning if result would overflow.
2017-06-02 09:06:36 +02:00
Werner Lemberg 3802ca8b64 [cff] Fix integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2027
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2028

* src/cff/cf2hints.c (cf2_hintmap_insertHint), src/cff/cf2intrp.c
(cf2_doFlex): Use OVERFLOW_ADD_INT32 and OVERFLOW_SUB_INT32.
2017-06-02 08:44:20 +02:00
Werner Lemberg cd02d359a6 [smooth] Some 32bit integer overflow run-time errors.
* src/smooth/ftgrays.c [STANDALONE] (OVERFLOW_ADD_LONG,
OVERFLOW_SUB_LONG, OVERFLOW_MUL_LONG, NEG_LONG): New macros.
[!STANDALONE]: Include FT_INTERNAL_CALC_H.
(gray_render_cubic): Use those macros where appropriate.
2017-06-01 17:05:39 +02:00
Werner Lemberg a607e3919d Minor comment. 2017-06-01 17:03:07 +02:00
Werner Lemberg 0ad3262366 * src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'. 2017-06-01 17:00:37 +02:00
Werner Lemberg 4a1f1a6d2a [psaux] 32bit integer overflow tun-time errors (#46149).
* src/psaux/t1decode.c (t1_decoder_parse_charstrings): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG where appropriate.
2017-06-01 13:15:54 +02:00
Werner Lemberg 8d435c463d * src/truetype/ttinterp.c (TT_RunIns): Adjust loop counter again.
Problem reported by Marek Kašík <mkasik@redhat.com>.

The problematic font that exceeds the old limit is Padauk-Bold,
version 3.002, containing bytecode generated by a buggy version of
ttfautohint.
2017-06-01 07:09:44 +02:00
Werner Lemberg e66d7300fe [cff] 32bit integer overflow run-time errors 2/2 (#46149).
This commit handles the new engine.

* include/freetype/internal/ftcalc.h (OVERFLOW_ADD_INT32,
OVERFLOW_SUB_INT32, OVERFLOW_MUL_INT32, NEG_INT, NEG_LONG,
NEG_INT32): New macros.

* src/cff/cf2ft.c (cf2_getScaleAndHintFlag): Use OVERFLOW_ADD_INT32.

* src/cff/cf2hints.c (cf2_getWindingMomentum, cf2_hint_init,
cf2_hintmap_map, cf2_glyphpath_hintPoint,
cf2_glyphpath_computeIntersection, cf2_glyphpath_computeOffset,
cf2_glyphpath_lineTo, cf2_glyphpath_curveTo): Use
OVERFLOW_ADD_INT32, OVERFLOW_SUB_INT32, OVERFLOW_MUL_INT32, and
NEG_INT32 where appropriate.

* src/cff/cf2intrp.c (cf2_doFlex, cf2_doBlend,
cf2_interpT2CharString): Ditto.
Also add some other code where needed to avoid overflow.
2017-05-31 16:16:50 +02:00
Werner Lemberg 9b710cd56e [cff] 32bit integer overflow run-time errors 1/2 (#46149).
This commit handles the old engine.

* src/cff/cffgload.c: Include FT_INTERNAL_CALC_H.
(cff_decoder_parse_charstrings): Use OVERFLOW_ADD_LONG and
OVERFLOW_SUB_LONG where needed.

* src/cff/cffparse.c: Include FT_INTERNAL_CALC_H.
(power_ten_limits): New static array.
(do_fixed): Use it to prevent multiplication overflow.
(cff_parser_run): Use OVERFLOW_ADD_LONG.
2017-05-30 22:35:41 +02:00
Werner Lemberg 0e7b9f864f [psaux] Correctly handle sequences of multiple number signs.
* src/psaux/psconv.c (PS_Conv_Strtol, PS_Conv_ToFixed): Return zero
if we encounter more than a single sign.
2017-05-30 22:22:19 +02:00
Werner Lemberg f01463297f [pcf] 32bit integer overflow run-time errors (#46149).
* src/pcf/pcfread.c (pcf_get_accel): Add sanity checks for
`fontAscent' and `fontDescent'.
(pcf_load_font): Add sanity checks for global height.
Add sanity checks for AVERAGE_WIDTH, POINT_SIZE, PIXEL_SIZE,
RESOLUTION_X, and RESOLUTION_Y properties.
2017-05-29 21:04:27 +02:00
Werner Lemberg fbe2fe4c75 Handle some integer overflow run-time errors (#46149, #48979).
This commit (mainly for 32bit CPUs) is the first of a series of
similar commits to handle known integer overflows.  Basically, all
of them are harmless, since they affect rendering of glyphs only,
not posing security threats.  It is expected that fuzzying will show
up more overflows, to be fixed in due course.

The idea is to mark places where overflows can occur, using macros
that simply cast to unsigned integers, because overflow arithmetic
is well defined in this case.  Doing so suppresses run-time errors
of sanitizers without adding computational overhead.

* include/freetype/internal/ftcalc.h (OVERFLOW_ADD_INT,
OVERFLOW_SUB_INT, OVERFLOW_MUL_INT, OVERFLOW_ADD_LONG,
OVERFLOW_SUB_LONG, OVERFLOW_MUL_LONG): New macros.

* src/base/ftcalc.c (FT_RoundFix, FT_CeilFix, FT_Matrix_Multiply,
FT_Matrix_Multiply_Scaled, FT_Vector_Transform_Scaled,
ft_corner_orientation): Use new macros.

* src/base/ftoutln.c (FT_Outline_Get_Orientation): Use new macros.
2017-05-29 13:29:28 +02:00
Werner Lemberg 9d04fa7015 * include/freetype/internal/ftcalc.h (FLOAT_TO_FIXED): Remove.
This macro is not used.
2017-05-28 07:57:24 +02:00
Werner Lemberg 2e4188d833 [cff] s/cf2_floatToFixed/cf2_doubleToFixed/.
The new name better describes what the macro actually does;
additionally, we don't need a trailing `f' for literals (there was
only a single such instance in the code, but this caused a clang
warning because the macro itself uses `double' literals).

* src/cff/cf2blues.c, src/cff/cf2blues.h, src/cff/cf2fixed.h,
src/cff/cf2font.c, src/cff/cf2hints.c: Updated.
2017-05-28 07:46:22 +02:00
Werner Lemberg 9357219082 Fix negation of INT_MIN and LONG_MIN (#46149).
* src/base/ftcalc.c (FT_MOVE_SIGN): Add argument to pass unsigned
value, to be used as the result.
(FT_MulDiv, FT_MulDiv_No_Round, FT_DivFix, FT_MulFix,
FT_Vector_NormLen): Updated.
2017-05-28 07:20:09 +02:00
Werner Lemberg a9331c0f4d [truetype] Fix handling of design coordinates (#51127).
* src/truetype/ttgxvar.c (tt_set_mm_blend): Compute all design
coordinates if we have to create the `blends->coord' array.
(TT_Get_MM_Blend, TT_Get_Var_Design): Select default instance
coordinates if no instance is selected yet.
2017-05-27 15:50:25 +02:00
Werner Lemberg 082f2faf50 [bdf, pcf] Support ISO646.1991-IRV character encoding (aka ASCII).
Problem reported by Marek Kašík <mkasik@redhat.com>, cf.

  https://bugzilla.redhat.com/show_bug.cgi?id=1451795

* src/bdf/bdfdrivr.c (BDF_Face_Init), src/pcf/pcfdrivr.c
(PCF_Face_Init): Implement it.
2017-05-24 07:40:46 +02:00
Nikolaus Waxweiler a0455468fd [truetype] Always use interpreter v35 for B/W rendering (#51051).
* src/truetype/ttgload.c (tt_loader_init)
[TT_SUPPORT_SUBPIXEL_HINTING_MINIMAL]: Adjust
`subpixel_hinting_lean', `grayscale_cleartype', and
`vertical_lcd_lean' accordingly.

* src/truetype/ttinterp.c (Ins_GETINFO): Updated.
(TT_RunIns): Update `backward_compatibility' flag.
2017-05-20 07:28:46 +02:00
Alexei Podtelezhnikov ab2599ea3f [smooth] Implement minimal dynamic padding for LCD filtering.
Extra bitmap padding for LCD filtering depends on the filter.  The
default 5-tap filter needs 2 extra subpixels.  The light 3-tap filter
needs only 1 extra subpixel.  This space could be already available
due to rounding.  In order to optimize the padding, we now expand
CBox for the given filter weights before rounding.

This change breakes current Skia (and Firefox).

* include/freetype/internal/ftobjs.h (FT_LibraryRec)
[FT_CONFIG_OPTION_SUBPIXEL_RENDERING]: Remove `lcd_extra' field.

* src/base/ftlcdfil.c (FT_Library_SetLcdFilterWeights,
FT_Library_SetLcdFilter): Remove `lcd_extra' initializations.

* src/smooth/ftsmooth.c (ft_smooth_render_generic): Implement dymanic
LCD padding.
2017-05-20 00:35:21 -04:00
Werner Lemberg 881f64475f [autofit] More code sorting. 2017-05-17 07:56:53 +02:00
Werner Lemberg 548704f426 Code sorting. 2017-05-17 07:40:50 +02:00
Werner Lemberg 5efda13f60 [sfnt] Return proper scaling values for SBIX bitmaps.
Problem reported by Hin-Tak Leung <htl10@users.sourceforge.net>.

* src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Implement it.
2017-05-15 21:26:01 +02:00
Werner Lemberg 6e5445a232 [truetype] Fix error handling for embedded bitmaps.
Problem reported by Hin-Tak Leung <htl10@users.sourceforge.net>.

* src/truetype/ttgload.c (TT_Load_Glyph)
[TT_CONFIG_OPTION_EMBEDDED_BITMAPS]: Handle error if font is not
scalable.
2017-05-15 21:24:04 +02:00
Alexei Podtelezhnikov a7f276a281 [autofit] Make autohint warping NORMAL option.
This moves warping option from LIGHT to NORMAL mode.  This makes LIGHT
truly void of hinting in x-direction, with left side bearing never
changed and right side bearing only altered by advance rounding.
Therefore, LIGHT is now ready to return fractional advance.  As a
NORMAL option, warping substitutes normal hinting.

* src/autofit/afcjk.c (af_cjk_hints_apply): Updated.
* src/autofit/aflatin.c (af_latin_hints_apply): Updated.
* src/autofit/aflatin2.c (af_latin2_hints_apply): Updated.

* src/autofit/afloader.c (af_loader_load_glyph): Handle warping
phantom points as normal.
2017-05-15 00:25:37 -04:00
Werner Lemberg e99b26aada Remove remnants of raster pool.
* include/freetype/internal/ftobjs.h (FT_LibraryRec): Remove
`raster_pool' and `raster_pool_size' fields.

* src/base/ftobjs.c (FT_New_Library), src/raster/ftrend1.c
(ft_raster1_init), src/smooth/ftsmooth.c (ft_smooth_init): Updated.
2017-05-14 21:57:27 +02:00
Werner Lemberg a12a34451a * Version 2.8 released.
=======================

Tag sources with `VER-2-8'.

* docs/VERSION.TXT: Add entry for version 2.8.
* docs/CHANGES: Updated.

* README, Jamfile (RefDoc), builds/windows/vc2005/freetype.vcproj,
builds/windows/vc2005/index.html,
builds/windows/vc2008/freetype.vcproj,
builds/windows/vc2008/index.html,
builds/windows/vc2010/freetype.vcxproj,
builds/windows/vc2010/index.html,
builds/windows/visualc/freetype.dsp,
builds/windows/visualc/freetype.vcproj,
builds/windows/visualc/index.html,
builds/windows/visualce/freetype.dsp,
builds/windows/visualce/freetype.vcproj,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/freetype.vcproj,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/freetype.vcproj,
builds/wince/vc2008-ce/index.html: s/2.7.1/2.8/, s/271/28/.

* include/freetype/freetype.h (FREETYPE_MINOR): Set to 8.
(FREETYPE_PATCH): Set to 0.

* builds/unix/configure.raw (version_info): Set to 20:0:14.
* CMakeLists.txt (VERSION_MINOR): Set to 8.
(VERSION_PATCH): Set to 0.
2017-05-13 06:29:04 +02:00
Werner Lemberg 538d571a99 formats.txt: Properly document PFB. 2017-05-13 06:28:08 +02:00
Hin-Tak Leung 603121c050 Fix `FT_UINT_TO_POINTER' macro for Windows.
* builds/unix/ftconfig.in, builds/vms/ftconfig.h,
include/freetype/config/ftconfig.h (FT_UINT_TO_POINTER) [_WIN64]:
Fix definition.
2017-05-12 07:52:36 +02:00
Werner Lemberg 2e209c6cbe Update CHANGES file. 2017-05-11 00:28:05 +02:00
Werner Lemberg 9de936d343 s/AF_BLUE_STRINGSET_CANADIAN_SYLLABICS/AF_BLUE_STRINGSET_CANS/. 2017-05-11 00:11:59 +02:00
Sascha Brawer ac0eed8646 [autofit] Add support for Chakma script.
* src/autofit/afblue.dat: Add blue zone data for Chakma.
* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Chakma standard character.

* src/autofit/afranges.c, src/autofit/afstyles.h: Add Chakma data.
2017-05-11 00:06:37 +02:00
Sascha Brawer d19859f16f [autofit] Add support for Kayah Li script.
* src/autofit/afblue.dat: Add blue zone data for Kayah Li.
* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Kayah Li standard character.

* src/autofit/afranges.c, src/autofit/afstyles.h: Add Kayah Li data.
2017-05-10 23:38:05 +02:00
Sascha Brawer 87218c9950 [autofit] Add support for Bamum script.
* src/autofit/afblue.dat: Add blue zone data for Bamum.
* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Bamum standard character.

* src/autofit/afranges.c, src/autofit/afstyles.h: Add Bamum data.
2017-05-10 12:39:33 +02:00
Sascha Brawer 4aa1aec1a3 [autofit] Add support for Saurashtra script.
* src/autofit/afblue.dat: Add blue zone data for Saurashtra.
* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Saurashtra standard character.

* src/autofit/afranges.c, src/autofit/afstyles.h: Add Saurashtra
data.
2017-05-10 09:36:13 +02:00