See Savannah bug #30975.
* src/cff/cffload.c (cff_charset_compute_cids): Ignore CID if
greater than 0xFFFFU. CFF font spec does not mention about
maximum CID in the font, but PostScript and PDF spec define
that maximum CID is 0xFFFFU.
See Savannah bug #30975.
* src/cff/cffload.c (cff_charset_compute_cids): Don't increment
max_cid after detecting max CID. The array CFF_Charset->cids
is allocated by max_cid + 1.
(cff_charset_cid_to_gindex): Permit CID is less than or equal
to CFF_Charset->max_cid.
* src/cff/cffobjs.c (cff_face_init): FT_Face->num_glyphs is
calculated as CFF_Charset->max_cid + 1.
* src/truetype/ttpload.c (tt_face_get_location): If `pos1', the
offset to the requested entry in `glyf' exceeds the end of the
table, return offset=0, length=0. If `pos2', the offset to the
next entry in `glyf' exceeds the end of the table, truncate
the entry length at the end of `glyf' table.
See Savannah bug #31040.
* src/sfnt/ttpost.c (load_post_names): Get the length of
`post' table and pass the limit of `post' table to
load_format_20() and load_format_25().
(load_format_20): Stop the parsing when we reached at the
limit of `post' table. If more glyph names are required,
they are filled by NULL names. See Savannah bug #31040.
* src/truetype/ttinterp.c (free_buffer_in_size): Don't duplicate
FT_GlyphZoneRec size->twilight to be freed. If duplicated,
FT_FREE() erases the duplicated pointers only and leave original
pointers. They can cause the double-free crash when the burst
errors occur in TrueType interpreter and free_buffer_in_size()
is invoked repeatedly. See Savannah bug #31040 for detail.
* src/truetype/ttinterp.c (TT_RunIns): Decrease the trace level
showing the error when the interpreter returns with an error,
from FT_TRACE7() to FT_TRACE1().
* src/truetype/ttinterp.c (free_buffer_in_size): New function to
free the buffer allocated during the interpretation of this glyph.
(TT_RunIns): Unset FT_Face->size->{cvt_ready,bytecode_ready} if
an error occurs in the bytecode interpretation. The interpretation
of invalid bytecode may break the function definitions and referring
them in later interpretation is danger. By unsetting these flags,
`fpgm' and `prep' tables are executed again in next interpretation.
Fix Savannah bug #30798, reported by Robert Swiecki.
* src/cff/cffload.c (cff_charset_load): Fix change from 2009-03-20:
The threshold for SIDs is not applicable here. I misinterpreted the
`SID values 65000 and above are available for implementation use'
sentence in the CFF specification.
Problem reported by Ivan Ninčić <inincic@pdftron.com>.
* src/base/ftobjs.c (FT_Done_Library): Specify the order of font
drivers in face closing process. Type42 faces should be closed
before TrueType faces, because a Type42 face refers another
internal TrueType face which is created from sfnt[] array on the
memory.
* src/truetype/ttinterp.c (BOUNDSL): New macro.
Change `BOUNDS' to `BOUNDSL' where appropriate.
* src/truetype/ttinterp.h (TT_ExecContextRec): Fix type of
`cvtSize'.
Problem reported by Tobias Wolf <towolf@gmail.com>.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Sigh. I'm apparently too silly to fix this
correctly in less than three tries.
Permit a face for Type1, Type42 and CFF without charmap,
patch by Tor Andersson.
* src/type1/t1objs.c (T1_Face_Init): Reset the error if it
is FT_Err_No_Unicode_Glyph_Name.
* src/type42/t42objs.c (T42_Face_Init): Ditto.
* src/cff/cffobjs.c (cff_face_init): Ditto.
Too serious check of errors by `FT_CMap_New' since 2010-07-04
is fixed. Reported by Tor Andersson.
* include/freetype/fterrdef.h
(PSnames_Err_No_Unicode_Glyph_Name): New error code to
indicate the Unicode charmap synthesis failed because
no Unicode glyph name is found.
* src/psnames/psmodule.c (ps_unicodes_init): Return
PSnames_Err_No_Unicode_Glyph_Name when no Unicode glyph name
is found in the font.
* src/cff/cffcmap.c (cff_cmap_unicode_init): Return
CFF_Err_No_Unicode_Glyph_Name when no SID is available.
* src/type1/t1objs.c (T1_Face_Init): Proceed if `FT_CMap_New'
is failed by the lack of Unicode glyph name.
* src/type42/t42objs.c (T42_Face_Init): Ditto.
* src/cff/cffobjs.c (cff_face_init): Ditto.
Problem reported by malc <av1474@comtv.ru>.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: It is possible that there is just a single byte
after the `hintmask' or `cntrmask', e.g., a `return' instruction.
Fix for Savannah bug #30059.
* src/cache/ftccmap.c (FTC_CMapCache_Lookup): Replace `16' the
minimum character code passed by a legacy rogue client by...
* include/freetype/config/ftoption.h (FT_MAX_CHARMAP_CACHEABLE):
This. It is undefined when FT_CONFIG_OPTION_OLD_INTERNALS is
undefined (thus the rogue client compatibility is not required).
* src/cff/cffobjs.c (cff_face_init): Abort the automatic
selection or synthesis of Unicode cmap subtable when the charmap
index exceeds FT_MAX_CHARMAP_CACHEABLE.
* src/sfnt/ttcmap.c (tt_face_build_cmaps): Issue error message
when the charmap index exceeds FT_MAX_CHARMAP_CACHEABLE.
* src/base/ftobjs.c (find_unicode_charmap): When Unicode charmap
is found after FT_MAX_CHARMAP_CACHEABLE, ignore it and search
earlier one.
(find_variant_selector_charmap): When UVS charmap is found after
FT_MAX_CHARMAP_CACHEABLE, ignore it and search earlier one.
(FT_Select_Charmap): When a charmap matching with requested
encoding but after FT_MAX_CHARMAP_CACHEABLE, ignore and search
earlier one.
(FT_Set_Charmap): When a charmap matching with requested
charmap but after FT_MAX_CHARMAP_CACHEABLE, ignore and search
earlier one.
(FT_Get_Charmap_Index): When a requested charmap is found
after FT_MAX_CHARMAP_CACHEABLE, return the inverted charmap
index.
* src/base/ftobjs.c (Mac_Read_POST_Resource): If the type
of the POST fragment is 0, the segment is completely ignored.
The declared length of the segment is not cared at all.
According to Adobe Technical Note 5040, type 0 segment is
comment only and should not be loaded for the interpreter.
Reported by Robert Swiecki.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Check `rlen'
the length of fragment declared in the POST fragment header
and prevent an underflow in length calculation. Some fonts
set the length to zero in spite of the exist of following
16bit `type'. Reported by Robert Swiecki.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Check the buffer
size during gathering PFB fragments embedded in LaserWriter PS
font for Macintosh. Reported by Robert Swiecki.
* src/smooth/ftgrays.c (gray_render_span): Use cast to `unsigned
int' to avoid integer overflow.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Use smaller
threshold values for `width' and `height'. This is not directly
related to the bug fix but makes sense anyway.
* src/cff/cffgload.c (cff_decoder_parse_charstrings)
<cff_op_hintmask>: Ensure that we don't exceed `limit' while parsing
the bit masks of the `hintmask' and `cntrmask' operators.
* src/base/ftstream.c (FT_Stream_EnterFrame): Exit with error
if the frame size is larger than the stream size.
* src/base/ftsystem.c (ft_ansi_stream_io): Exit with error if
seeking a position larger than the stream size.
* src/base/ftobjs.c (Mac_Read_POST_Resource): Check the error during
reading a PFB fragment embedded in LaserWriter PS font for Macintosh.
Reported by Robert Swiecki.
* src/bdf/bdflib.c (_bdf_readstream): Use special error code to
indicate a redo operation.
(_bdf_parse_start): Handle `CHARS' keyword here too and pass current
input line to `_bdf_parse_glyph'.
* include/freetype/fterrdef.h
(BDF_Err_Missing_Fontboundingbox_Field): New error code.
* src/bdf/bdflib.c (_bdf_parse_start): Check for missing
`FONTBOUNDINGBOX' field.
Avoid memory leak if there are multiple `FONT' lines (which is
invalid but doesn't hurt).
Point numbers for FreeType's implementation of hinting masks are
collected before the final number of points of a glyph has been
determined; in particular, the code for handling the `endchar'
opcode can reduce the number of points.
* src/pshinter/pshalgo.c (psh_glyph_find_strong_points): Assure that
`end_point' is not larger than `glyph->num_points'.
This bug has been introduced with commit 2415cbf3.
* src/base/ftobjs.c (FT_Get_First_Char, FT_Get_Next_Char): Protect
against endless loop in case of corrupted font header data.
Suggested by Graham.
* src/autofit/afhints.c (af_glyph_hints_compute_inflections):
Removed.
(af_glyph_hints_reload): Remove third argument.
Update all callers.
Acroread does the same.
* src/truetype/ttgload.c (TT_Process_Composite_Glyph): Call
`Update_Max' to adjust size of instructions array if necessary and
add a rough safety check.
(load_truetype_glyph): Save `loader->byte_len' before recursive
call.
* src/truetype/ttinterp.h, src/truetype/ttinterp.c (Update_Max):
Declare it as FT_LOCAL.
Previously we discovered fonts which used `setcurrentpoint' to set
the initial point of a contour to 0,0. This caused FreeType to
raise an error, because the `setcurrentpoint' operator is only
supposed to be used with the results from an OtherSubr subroutine.
This was fixed by simply ignoring the error and carrying on.
Now we have found a font which uses setcurrentpoint to actually
establish a non-zero point for a contour during the course of a
glyph program. FWIW, these files may be produced by an application
called `Intaglio' on the Mac, when converting TrueType fonts to
Type 1.
The fix allows the new invalid behaviour, the old invalid behaviour
and real proper usage of the operator to work the same way as Adobe
interpreters apparently do.
(t1_decoder_parse_charstrings): Make `setcurrentpoint' use the top
two elements of the stack to establish unconditionally the current x
and y coordinates.
Make the `flex' subroutine handling (OtherSubr 0) put the current
x,y coordinates onto the stack, instead of two dummy uninitialised
values.
This is based on code written by Lifter
<http://unixforum.org/index.php?showuser=11691>. It fixes
FreeDesktop bug #27386.
* src/base/ftlcdfil.c (FT_Library_SetLcdFilterWeights): New
function.
* include/freetype/ftlcdfil.h: Updated.
* docs/CHANGES: Updated.
We do this by avoiding memory allocation and file I/O. This is
Savannah patch #7104.
* src/cff/cfftypes.h: Include PS cmaps service and
FT_INTERNAL_POSTSCRIPT_HINTS_H.
(CFF_SubFontRec): Remove `num_local_subrs'.
(CFF_FontRec): Add `num_strings', `strings', and `string_pool'
fields.
Remove `string_index' and `num_global_subrs' fields.
Use real types instead of `void' for `pshinter' and `psnames' fields.
* src/cff/cffload.c: Don't include PS cmaps service.
(cff_index_get_pointers): Add `pool' parameter which allows to
insert an extra NUL character for each String INDEX entry.
(cff_index_get_name): Make it a local function.
(cff_index_get_string): New function.
(cff_subfont_load): Updated.
(cff_font_load): Initialize `num_strings', `strings', and
`string_pool' fields in the `CFF_FontRec' structure.
(cff_index_get_sid_string): Use `cff_index_get_string' instead of
`cff_index_get_name'.
(cff_font_done): Updated.
* src/cff/cffload.h: Don't include PS cmaps service.
(cff_index_get_string): Added.
(cff_index_get_sid_string): Updated.
* src/cff/cffobjs.c: Don't include PS cmaps service and
FT_INTERNAL_POSTSCRIPT_HINTS_H.
(cff_size_get_globals_funcs, cff_slot_init): Updated.
(cff_face_init): Follow `cff_index_get_name',
`cff_index_get_string', and `cff_index_get_sid_string' changes.
* src/cff/cffcmap.c (cff_sid_free_glyph_name): Removed.
(cff_sid_to_glyph_name): Use `cff_index_get_cid_string'.
(cff_cmap_unicode_init): Updated.
* src/cff/cffdrivr.c: Don't include PS cmap service.
(cff_get_glyph_name): Avoid unnecessary lookup for POSTSCRIPT_CMAPS
service.
(cff_get_glyph_name, cff_ps_get_font_info, cff_get_ros): Follow API
`cff_index_get_sid_string' change.
(cff_get_name_index): Use `cff_index_get_string' instead of
`cff_index_get_name'.
* src/cff/cffgload.c: Don't include FT_INTERNAL_POSTSCRIPT_HINTS_H.
(cff_decoder_init, cff_decoder_prepare): Updated.
Initialize phantom points before calling the incremental interface
to update glyph metrics.
* src/truetype/ttgload.c (tt_get_metrics_incr_overrides)
[FT_CONFIG_OPTION_INCREMENTAL]: New function, split off from...
(tt_get_metrics): This.
Updated.
(load_truetype_glyph): Use tt_get_metrics_incr_overrides.
==========================
Tag sources with `VER-2-3-12'.
* docs/CHANGES: Updated.
* docs/VERSION.DLL: Update documentation and bump version number to
2.3.12.
* README, Jamfile (RefDoc),
builds/win32/vc2005/freetype.vcproj, builds/win32/vc2005/index.html,
builds/win32/vc2008/freetype.vcproj, builds/win32/vc2008/index.html,
builds/win32/visualc/freetype.dsp,
builds/win32/visualc/freetype.vcproj,
builds/win32/visualc/index.html, builds/win32/visualce/freetype.dsp,
builds/win32/visualce/freetype.vcproj,
builds/win32/visualce/index.html,
builds/wince/vc2005-ce/freetype.vcproj,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/freetype.vcproj,
builds/wince/vc2008-ce/index.html: s/2.3.11/2.3.12/, s/2311/2312/.
* include/freetype/freetype.h (FREETYPE_PATCH): Set to 12.
* builds/unix/configure.raw (version_info): Set to 10:0:4.
Since we consider `sbw' for the horizontal direction only, we still have
to synthesize vertical metrics if the user wants to use the vertical
writing direction.
* src/cff/cffgload.c (cff_slot_load), src/cid/cidgload.c
(cid_slot_load_glyph), src/type1/t1gload.c (T1_Load_Glyph):
Synthesize vertical metrics (only) if FT_LOAD_VERTICAL_LAYOUT is
set.
After long discussion, we now consider the character width vector
(wx,wy) returned by the `sbw' Type 1 operator as being part of *one*
direction only. For example, if you are using the horizontal
writing direction, you get the horizontal and vertical components of
the advance width for this direction. Note that OpenType and CFF fonts
don't have such a vertical component; instead, the GPOS table can be
used to generate two-dimensional advance widths (but this isn't
handled by FreeType).
* include/freetype/ftincrem.h (FT_Incremental_MetricsRec): Add
`advance_v' field to hold the vertical component of the advance
value.
* src/truetype/ttgload.c (tt_get_metrics), src/cff/cffgload.c
(cff_slot_load), src/type1/t1gload.c
(T1_Parse_Glyph_And_Get_Char_String), src/cid/cidgload.c
(cid_load_glyph): Use it.
Issue #28226 involved a work-around for a font which used the
`setcurrentpoint' operator in an invalid way; this operator is only
supposed to be used with the result of OtherSubrs, and the font used
it directly. The supplied patch removed the block of code which
checked this usage entirely.
This turns out to be a Bad Thing. If `setcurrentpoint' is being
used correctly it should reset the flex flag in the decoder. If we
don't do this then the flag never gets reset and we omit any further
contours from the glyph (at least until we close the path or
similar).
* src/psaux/t1decode.c (t1_decoder_parse_charstrings)
<op_setcurrentpoint>: Handle `flex_state' correctly.
* src/base/ftglyph.c (FT_Glyph_To_Bitmap) [FT_CONFIG_OPTION_PIC]:
Declare `library' for FT_BITMAP_GLYPH_CLASS_GET.
* src/base/ftinit.c (ft_destroy_default_module_classes,
ft_create_default_module_classes): Use proper casts (needed for C++
compilation).
* src/sfnt/ttcmap.c (tt_cmap13_class_rec): Use FT_DEFINE_TT_CMAP.
Reported by Sean.
* src/base/ftdbgmem.c [!FT_DEBUG_MEMORY]: ANSI C doesn't like empty
source files; however, some compilers warn about an unused variable
declaration. This is now replaced with a typedef.
There exist corrupt, subsetted fonts (embedded in PDF files) which
contain a private dict that ends with an unterminated floating point
number (no operator following). We now ignore this error (as
acrobat does).
* src/cff/cffparse.c (cff_parser_run): Don't emit a syntax error for
unterminated floating point numbers.
This fixes Savannah bug #28226.
At least two wild PostScript files of unknown provenance contain
Type 1 fonts, apparently converted from TrueType fonts in earlier
PDF versions of the files, which use the `setcurrentpoint' operator
inappropriately.
FreeType currently throws an error in this case, but Ghostscript and
Adobe Distiller both accept the fonts and ignore the problem. This
commit #ifdefs out the check so PostScript interpreters using
FreeType can render these files.
The specification says `setcurrentpoint' should only be used to set
the point after a `Subr' call, but these fonts use it to set the
initial point to (0,0). Unnecessarily so, as they correctly use an
`hsbw' operation which implicitly sets the initial point.
Reported by Sean McBride <sean@rogue-research.com>.
* src/tools/apinames.c (read_header_file)<STATE_TYPE>: Use a cast to
`int', as specified in the printf(3) man page.
* src/cff/cffobjs.c (cff_face_init), src/cid/cidobjs.c
(cid_face_init), src/type1/t1afm.c (T1_Read_Metrics),
src/type1/t1objs.c (T1_Face_Init): Don't use unsigned constant
values for rounding if the argument can be negative.
* src/cff/cffgload.c (CFF_Operator, cff_argument_counts): Handle
`seac', `sbw', and `setcurrentpoint' opcodes.
(cff_compute_bias): Add parameter to indicate the charstring type.
Update all callers.
(cff_operator_seac): Add parameter for side bearing.
(cff_decoder_parse_charstrings): Updated for more Type1 support.
Reported by Jeremy Manson <jeremy.manson@gmail.com>.
src/truetype/ttgload.c (load_truetype_glyph): Add parameter to
quickly load the glyph header only.
Update all callers.
(tt_loader_init): Add parameter to quickly load the `glyf' table
only.
Update all callers.
(TT_Load_Glyph): Compute linear advance values for embedded bitmap
glyphs too.
suzuki toshiya