The vstore->regionCount and vstore->dataCount were read directly
from the data. However, vstore->varRegionList and vstore->varData
would still contain uninitialized entries with uninitialized
pointers in the event of an error, leading to issues when attempting
to clean up.
Reportd as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40104
* src/cff/cffload.c (cff_vstore_load): Read the region and data counts
into locals and update the vstore counts immediately after each entry
becomes free-able.
Loops with unsigned decrement can be reliably stopped when the counter
wraps around after reaching zero.
* src/cff/cffload.c (cff_charset_compute_cids): Use unsigned counter.
* src/pshinter/pshalgo.c (psh_hint_table_activate_mask): Ditto.
* src/pshinter/pshrec.c (ps_mask_table_merge): Ditto.
This ensures good logging output, with all lines having a proper
prefix (if requested).
This is a continuation of a similar patch from 2020-12-02, which
missed some locations.
* src/cff/cffload.c (cff_index_get_pointers): When new_bytes fails
to allocate, make sure to free the table. Do the same for both
allocations if there is a later error.
We no longer have to take care of the 8.3 file name limit; this
allows us (a) to introduce longer, meaningful file names, and (b) to
avoid macro names in `#include' lines altogether since some
compilers (most notably Visual C++) doesn't support this properly.
*/*: Replace
#include FOO_H
with
#include <freetype/foo.h>
or something similar. Also update the documentation.
* src/base/ftoutln.c (FT_Outline_Transform): Bail on empty points.
* src/cff/cffload.c (cff_subfont_load): Use `FT_OFFSET'.
* src/psaux/psft.c (cf2_decoder_parse_substrings): Early out if
`charstring_base' or `charstring_len' are null.
* src/sfnt/ttload.c (tt_face_load_name): Use `FT_OFFSET'.
This monster commit was created by applying Nikhil's scripts
`docconverter.py' and `markify.py' to all C header and source files,
followed up by minor manual clean-up.
No change in functionality, of course.
I used commit f7419907bc6044b9b7057f9789866426c804ba82 from
https://github.com/nikramakrishnan/freetype-docs.git.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7371
* src/cff/cffload.c (cff_load_private_dict): Sanitize
`priv->blue_shift' and `priv->blue_fuzz' to avoid overflows later
on.
* src/type1/t1load.c (T1_Open_Face): Ditto.
* include/freetype/internal/fttrace.h: Remove unused tracing macros.
s/pshalgo2/pshalgo/.
Add `trace_cffdecode'.
* src/pshinter/pshalgo.c (FT_COMPONENT): Updated.
* src/cff/cffload.c: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/cff/cffobjs.c: Include FT_SERVICE_METRICS_VARIATIONS_H and
FT_SERVICE_CFF_TABLE_LOAD_H.
* src/cid/cidriver.c: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/psaux/cffdecode.c: Include FT_FREETYPE_H and
FT_INTERNAL_DEBUG_H.
(FT_COMPONENT): Define.
* src/psaux/cffdecode.h: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/psaux/psauxmod.h: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
Declare `cff_builder_funcs' and `ps_builder_funcs'.
* src/psaux/psft.c: Include `psobjs.h' and `cffdecode.h'.
* src/psaux/psobjs.c : Include `psauxmod.h'.
* src/base/ftobjs.c (FT_New_Library): C4702: unreachable code.
(ft_glyphslot_preset_bitmap): C4244: possible loss of data.
* src/cff/cffload.c (cff_blend_doBlend): C4244: possible loss of data.
Turn `sum' into unsigned.
* include/freetype/internal/cfftypes.h (CFF_FontRec): Add
`font_extra' entry.
* src/cff/cffdrivr.c (cff_ps_get_font_extra): New function to
retrieve FSType info from the embedded PostScript data.
(cff_service_ps_info): Register function.
* src/cff/cffload.c (cff_font_done): Free `font_extra'.
This is so that we can use the same hinting engine parameters for
Type 1.
* include/freetype/internal/cffotypes.h (CFF_Driver): Rename and
move to...
* include/freetype/internal/psaux.h (PS_Driver): ...here.
* src/cff/cffdrivr.c, src/cff/cffgload.c, src/cff/cffload.c,
src/cff/cffobjs.c, src/cff/cffobjs.h, src/psaux/psft.c,
src/psaux/psobjs.c: Update references.
NOTE: Does not compile!
Minor fix to allow both `cff' and `psaux' to use `cff_random'.
* src/cff/cffload.c (cff_random): Move to...
* src/psaux/psobjs.c: Here.
* src/cff/cffload.h: Move corresponding declaration to
`src/psaux/psobjs.h'.
* include/freetype/internal/psaux.h (PSAux_ServiceRec): Register the
function here...
* src/psaux/psauxmod.c: And here.
* src/cff/cffload.c, src/psaux/cf2intrp.c: Update code.
* src/cff/cffload.c (cff_blend_build_vector): Explicitly build blend
vector when `lenNDV' is zero; don't rely on zero-init.
Save `lenNDV' as part of cache key even when `lenNDV' is zero.
* include/freetype/internal/services/svmm.h (FT_Get_Var_Blend_Func):
Add `normalizedcoords' argument.
* src/truetype/ttgxvar.h (GX_BlendRec): Add `coords' field to store
the design coordinates of the current instance.
Updated.
* src/truetype/ttgxvar.c (TT_Set_MM_Blend): Move functionality to...
(tt_set_mm_blend): ... New function.
Convert data in `normalizedcoords' array to `coords' array on
demand.
(TT_Set_Var_Design): Store argument data in `coords' array.
(TT_Get_Var_Design): Get data from `coords' array.
(tt_get_var_blend): Updated.
(tt_done_blend): Updated.
* src/cff/cffload.c, src/cff/cffload.h (cff_get_var_blend): Updated.
* src/cff/cf2ft.c (cf2_getNormalizedVector): Updated.
* src/cff/cffobjs.c (cff_face_init): Updated.
Werner Lemberg