From fb69029a7afc0b870a465b3ad39540fa589863c0 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Wed, 23 Jun 2010 10:00:52 +0200
Subject: [PATCH] Fix Savannah bug #30220.

* include/freetype/fterrdef.h
(BDF_Err_Missing_Fontboundingbox_Field): New error code.

* src/bdf/bdflib.c (_bdf_parse_start): Check for missing
`FONTBOUNDINGBOX' field.
Avoid memory leak if there are multiple `FONT' lines (which is
invalid but doesn't hurt).
---
 ChangeLog                   | 12 ++++++++++++
 include/freetype/fterrdef.h | 18 ++++++++++--------
 src/bdf/bdflib.c            | 11 +++++++++++
 3 files changed, 33 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a1f428861..f3fd6cad7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2010-06-23  Werner Lemberg  <wl@gnu.org>
+
+	Fix Savannah bug #30220.
+
+	* include/freetype/fterrdef.h
+	(BDF_Err_Missing_Fontboundingbox_Field): New error code.
+
+	* src/bdf/bdflib.c (_bdf_parse_start): Check for missing
+	`FONTBOUNDINGBOX' field.
+	Avoid memory leak if there are multiple `FONT' lines (which is
+	invalid but doesn't hurt).
+
 2010-06-21  Werner Lemberg  <wl@gnu.org>
 
 	Fix Savannah bug #30168.
diff --git a/include/freetype/fterrdef.h b/include/freetype/fterrdef.h
index d7ad256bd..ceda1a9c2 100644
--- a/include/freetype/fterrdef.h
+++ b/include/freetype/fterrdef.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType error codes (specification).                                */
 /*                                                                         */
-/*  Copyright 2002, 2004, 2006, 2007 by                                    */
+/*  Copyright 2002, 2004, 2006, 2007, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -220,19 +220,21 @@
                 "`FONT' field missing" )
   FT_ERRORDEF_( Missing_Size_Field,                          0xB2, \
                 "`SIZE' field missing" )
-  FT_ERRORDEF_( Missing_Chars_Field,                         0xB3, \
+  FT_ERRORDEF_( Missing_Fontboundingbox_Field,               0xB3, \
+                "`FONTBOUNDINGBOX' field missing" )
+  FT_ERRORDEF_( Missing_Chars_Field,                         0xB4, \
                 "`CHARS' field missing" )
-  FT_ERRORDEF_( Missing_Startchar_Field,                     0xB4, \
+  FT_ERRORDEF_( Missing_Startchar_Field,                     0xB5, \
                 "`STARTCHAR' field missing" )
-  FT_ERRORDEF_( Missing_Encoding_Field,                      0xB5, \
+  FT_ERRORDEF_( Missing_Encoding_Field,                      0xB6, \
                 "`ENCODING' field missing" )
-  FT_ERRORDEF_( Missing_Bbx_Field,                           0xB6, \
+  FT_ERRORDEF_( Missing_Bbx_Field,                           0xB7, \
                 "`BBX' field missing" )
-  FT_ERRORDEF_( Bbx_Too_Big,                                 0xB7, \
+  FT_ERRORDEF_( Bbx_Too_Big,                                 0xB8, \
                 "`BBX' too big" )
-  FT_ERRORDEF_( Corrupted_Font_Header,                       0xB8, \
+  FT_ERRORDEF_( Corrupted_Font_Header,                       0xB9, \
                 "Font header corrupted or missing fields" )
-  FT_ERRORDEF_( Corrupted_Font_Glyphs,                       0xB9, \
+  FT_ERRORDEF_( Corrupted_Font_Glyphs,                       0xBA, \
                 "Font glyphs corrupted or missing fields" )
 
 
diff --git a/src/bdf/bdflib.c b/src/bdf/bdflib.c
index 6ce5c26c2..e4553e090 100644
--- a/src/bdf/bdflib.c
+++ b/src/bdf/bdflib.c
@@ -2082,6 +2082,14 @@
     /* Check for the start of the properties. */
     if ( ft_memcmp( line, "STARTPROPERTIES", 15 ) == 0 )
     {
+      if ( !(p->flags & _BDF_FONT_BBX ) )
+      {
+        /* Missing the FONTBOUNDINGBOX field. */
+        FT_ERROR(( "_bdf_parse_start: " ERRMSG1, lineno, "FONTBOUNDINGBOX" ));
+        error = BDF_Err_Missing_Fontboundingbox_Field;
+        goto Exit;
+      }
+
       error = _bdf_list_split( &p->list, (char *)" +", line, linelen );
       if ( error )
         goto Exit;
@@ -2144,6 +2152,9 @@
         goto Exit;
       }
 
+      /* Allowing multiple `FONT' lines (which is invalid) doesn't hurt... */
+      FT_FREE( p->font->name );
+
       if ( FT_NEW_ARRAY( p->font->name, slen + 1 ) )
         goto Exit;
       FT_MEM_COPY( p->font->name, s, slen + 1 );