These tests should mainly help avoid unnecessarily large memory
allocations in case of malformed fonts.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints,
ft_var_readpackeddeltas): Check number of points against stream
size.
(ft_var_load_avar): Check `pairCount' against table length.
(ft_var_load_gvar): Check `globalCoordCount' and `glyphCount'
against table length.
(tt_face_vary_cvt): Check `tupleCount' and `offsetToData'.
Fix trace.
(TT_Vary_Apply_Glyph_Deltas): Fix trace.
Free `sharedpoints' to avoid memory leak.
For functions querying a face, bits 16-30 of the face index can hold
the named instance index if we have a GX font. The indices start
with value 1; value 0 indicates font access without GX variation
data.
* include/freetype/freetype.h (FT_FaceRec): Update documentation.
* include/freetype/internal/sfnt.h: Ditto.
* src/sfnt/sfobjs.c (sfnt_init_face)
[TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Get number of named instances and
do argument checks.
(sfnt_load_face): Updated.
* src/truetype/ttobjs.c (tt_face_init)
[TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Use named instance, overwriting
the style name.
* src/base/ftobjs.c (open_face_from_buffer,
open_face_PS_from_sfnt_stream): Updated.
* src/bdf/bdfdrivr.c (BDF_Face_Init): Updated.
* src/cff/cffload.c (cff_font_load): Updated.
* src/cff/cffobjs.c (cff_face_init): Make function exit early for
pure CFF fonts if `font_index < 0'.
Updated.
* src/cid/cidobjs.c (cid_face_init): Updated.
* src/pcf/pcfdrivr.c (PCF_Face_Init): Updated.
* src/pfr/pfrobjs.c (pfr_face_init): Updated.
* src/type1/t1objs.c (T1_Face_Init): Updated.
* src/type42/t42objs.c (T42_Face_Init): Updated.
* src/winfonts/winfnt.c (fnt_face_get_dll_font, FNT_Face_Init):
Updated.
* docs/CHANGES: Updated.
* src/pfr/pfrgload.c (pfr_glyph_load_compound): Use multiplication,
not left-shift.
* src/truetype/ttgxvar.c (ft_var_load_avar, ft_var_load_gvar,
tt_face_vary_cvt, TT_Vary_Apply_Glyph_Deltas): Use multiplication,
not left-shift.
* src/base/ftrfork.c (FT_Raccess_Get_HeaderInfo): Only accept
positive values from header.
Check overflow.
* src/base/ftoutln.c (SCALED): Correctly handle left-shift of
negative values.
* src/bdf/bdf.h (_bdf_glyph_modified, _bdf_set_glyph_modified,
_bdf_clear_glyph_modified): Use unsigned long constant.
* src/bdf/bdfdrivr.c (BDF_Size_Select, BDF_Glyph_Load): Don't
left-shift values that can be negative.
* src/pcf/pcfdrivr.c (PCF_Size_Select, PCF_Glyph_Load): Don't
left-shift values that can be negative.
* src/raster/ftraster.c (SCALED): Correctly handle left-shift of
negative values.
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Don't left-shift
values that can be negative.
* src/truetype/ttgload.c (TT_Load_Composite_Glyph,
compute_glyph_metrics, load_sbit_image): Don't left-shift values
that can be negative.
See
http://lists.nongnu.org/archive/html/freetype-devel/2015-07/msg00008.html
for a rationale.
* src/autofit/afpic.h, src/base/basepic.h, src/cff/cffpic.h,
src/pshinter/pshpic.h, src/psnames/pspic.h, src/raster/rastpic.h,
src/sfnt/sfntpic.h, src/smooth/ftspic.h, src/truetype/ttpic.h
(FT_BEGIN_HEADER, FT_END_HEADER): Move macro calls to not enclose
header files that contain FT_{BEGIN,END}_HEADER macros by
themselves.
* src/autofit/aftypes.h [FT_DEBUG_AUTOFIT]: Include
FT_CONFIG_STANDARD_LIBRARY_H earlier.
* src/truetype/ttpic.h: Include FT_INTERNL_PIC_H.
This is just very basic stuff and just a little bit tested on
GNU/Linux only. I won't delve into this since I'm not a Jam user.
* Jamfile: Call `HDRMACRO' for `ftserv.h' also.
(DEFINES): Replace with...
(CCFLAGS): ... this.
* src/Jamfile: Don't call `HDRMACRO' for `internal.h'; this is
already handled in the top-level Jamfile.
* src/autofit/Jamfile (DEFINES): Replace with...
(CCFLAGS): ... this.
(_sources): Add missing files.
* src/cache/Jamfile: Don't call `HDRMACRO' for `ftcache.h'; it no
longer contains macro header definitions.
* src/base/Jamfile, src/cff/Jamfile, src/sfnt/Jamfile,
src/truetype/Jamfile (_sources): Add missing files.
=======================
Tag sources with `VER-2-6'.
* docs/VERSION.DLL: Update documentation and bump version number to
2.6.
* README, Jamfile (RefDoc), builds/windows/vc2005/freetype.vcproj,
builds/windows/vc2005/index.html,
builds/windows/vc2008/freetype.vcproj,
builds/windows/vc2008/index.html,
builds/windows/vc2010/freetype.vcxproj,
builds/windows/vc2010/index.html,
builds/windows/visualc/freetype.dsp,
builds/windows/visualc/freetype.vcproj,
builds/windows/visualc/index.html,
builds/windows/visualce/freetype.dsp,
builds/windows/visualce/freetype.vcproj,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/freetype.vcproj,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/freetype.vcproj,
builds/wince/vc2008-ce/index.html: s/2.5.5/2.6/, s/255/26/.
* include/freetype/freetype.h (FREETYPE_MINOR): Set to 6.
(FREETYPE_PATCH): Set to 0.
* builds/unix/configure.raw (version_info): Set to 18:0:12.
* CMakeLists.txt (VERSION_MINOR): Set to 0.
(VERSION_PATCH): Set to 6.
* src/autofit/afmodule.c [!FT_MAKE_OPTION_SINGLE_OBJECT]: Add
declarations for dumping functions.
* src/truetype/ttinterp.c (TT_New_Context): Pacify compiler.
* builds/toplevel.mk: Use `freetype.mk's code to compute the version
string.
Don't include a zero patch level in version string.
* builds/freetype.mk: Remove code for computing the version string.
Problem reported by Grissiom <chaos.proton@gmail.com>; in
http://lists.nongnu.org/archive/html/freetype/2015-05/msg00013.html
there is an example code to trigger the bug.
* src/truetype/ttobjs.c (tt_size_init_bytecode): Free old `size'
data before allocating again. Bug most probably introduced four
years ago in version 2.4.3.
* src/truetype/ttinterp.c: Change all existing TRACE7 calls to
TRACE6.
(opcode_name): Add string lengths.
(TT_RunIns): Implement display of code position and stack.
This is completely missing in Apple's documentation: If a `gvar'
tuple uses private point numbers (this is, deltas are specified for
some points only), the uncovered points must be interpolated for
this tuple similar to the IUP bytecode instruction. Examples that
need this functionality are glyphs `Oslash' and `Q' in Skia.ttf.
* src/truetype/ttgxvar.c (tt_delta_shift, tt_delta_interpolate,
tt_handle_deltas): New functions.
(TT_Vary_Get_Glyph_Deltas): Renamed to...
(TT_Vary_Apply_Glyph_Deltas): ... this; it directly processes the
points and does no longer return an array of deltas.
Add tracing information.
Call `tt_handle_deltas' to interpolate missing deltas.
Also fix a minor memory leak in case of error.
* src/truetype/ttgxvar.h: Updated.
* src/truetype/ttgload.c (TT_Process_Simple_Glyph,
load_truetype_glyph): Updated.
* src/truetype/ttgload.c, src/truetype/ttinterp.c: Guard new code
with `TT_CONFIG_OPTION_SUBPIXEL_HINTING'.
Problem reported by Nikolaus Waxweiler <madigens@gmail.com>.
This flag activates `native ClearType hinting', disabling backwards
compatibility mode as described in Greg Hitchcocks whitepaper. In
other words, it enables unrestricted functionality of all TrueType
instructions in ClearType.
* src/truetype/ttgload.c (tt_get_metrics): Call `sph_set_tweaks'
unconditionally.
(tt_loader_init): Unset `ignore_x_mode' flag if bit 2 of
`GS.instruct_control' is active.
* src/truetype/ttinterp.c (Ins_INSTCTRL): Handle selector index 3.
(Ins_GETINFO): Updated.
* docs/CHANGES: Document it.
* src/truetype/ttgload.c (TT_Load_Composite_Glyph): If the
ARGS_ARE_XY_VALUES flag is not set, handle argument values as
unsigned. I trust `ttx' (which has exactly such code) that it does
the right thing here...
The reason that noone has ever noticed this bug is probably the fact
that point-aligned subglyphs are rare, as are subglyphs with a
number of points in the range [128;255], which is quite large (or
even in the range [32768;65535], which is extremely unlikely).
This commit allows `num_coords' to be larger or smaller than the
number of available axes while selecting a design instance, either
ignoring excess data or using defaults if data is missing.
* src/truetype/ttgxvar.c (TT_Set_MM_Blend, TT_Set_Var_Design):
Implement it.
* src/type1/t1load.c (T1_Set_MM_Blend, T1_Set_MM_Design,
T1_Set_Var_Design): Ditto.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Correctly handle
single-element runs. Cf. glyph `Q' in Skia.ttf with weights larger
than the default.
* src/truetype/ttgxvar.c (ft_var_readpackedpoints): Fix return value
of `point_cnt' if two bytes are read.
Use a more vertical coding style.
(ft_var_readpackeddeltas): Use FT_UInt for `delta_cnt' parameter.
Use a more vertical coding style.
This is hard-coded to value 2 in `fvar' version 1.0 (and no newer
version exists), but some fonts set it incorrectly.
Problem reported by Adam Twardoch <adam@fontlab.com>.
* src/truetype/ttgload.c (load_truetype_glyph): For incremental
fonts, the glyph index may be greater than the number of glyphs
indicated, so guard the check with a preprocessor conditional.
Previously the code had stipulation for using a per-TT_Size exec
context if `size->debug' was true. But there was no way that
`size->debug' could *ever* be true. As such, the code was always
using the singleton `TT_ExecContext' that was stored in `TT_Driver'.
This was, clearly, not threadsafe.
With this patch, loading glyphs from different faces from different
threads doesn't crash in the bytecode loader code.
* src/truetype/ttobjs.h (TT_SizeRec): Remove `debug' member.
(TT_DriverRec): Remove `context' member.
* src/truetype/ttobjs.c (tt_size_run_fpgm, tt_size_run_prep): Remove
`TT_ExecContext' code related to a global `TT_Driver' object.
(tt_driver_done): Don't remove `TT_ExecContext' object here but ...
(tt_size_done_bytecode): ... here.
(tt_driver_init): Don't create `TT_ExecContext' object here but ...
(tt_size_init_bytecode): ... here, only on demand.
* src/truetype/ttinterp.c (TT_Run_Context): Remove defunct debug
code.
(TT_New_Context): Remove `TT_ExecContext' code related to a global
`TT_Driver' object.
* src/truetype/ttinterp.h: Updated.
* src/truetype/ttgload.c (TT_Hint_Glyph, tt_loader_init): Updated.
Werner Lemberg