It is possible for OtherSubr 19 to be invoked when `decoder->buildchar` is
NULL (so that `decoder->len_buildchar` is 0), the `blend` is non-NULL with
`blend->num_designs` set to 2, and the user supplied `idx` to be large (for
example 0xFFFFFFFE). Since these are all `FT_UInt32` the existing bounds
check overflows in a well defined manner, allowing for an invalid call to
`memcpy`.
In addition, it is possible to call OtherSubr 19 with
`decoder->len_buildchar`, `blend->num_designs`, and `idx` all zero (implying
that `blend->weight_vector` and `decoder->buildchar` are NULL). This passes
the bounds check (it is logically always fine to copy nothing starting at
index zero) but may invoke undefined behavior in `ft_memcpy` if it is backed
by `memcpy`. Calling `memcpy` with either the `src` or `dst` NULL is
undefined behavior (even if `count` is zero).
* src/psaux/psintrp.c (cf2_interpT2CharString): Correctly check that
`blend->num_designs` can be copied to `decoder->buildchar[idx]`.
Also avoid passing NULL to `ft_memcpy`.
Bug: https://crbug.com/1299259
The old impleemntation was not using `FT_REALLOC`, buing too careful
with the offset rebasing. It shoudl be safe to rely on the base
movements.
* src/psaux/psobjs.c (reallocate_t1_table, shift_elements): Combine
into...
(ps_table_realloc): ... this function based on `FT_REALLOC`.
(ps_table_done): Simplified.
(ps_table_add): Updated.
* src/base/ftrfork.c (raccess_make_file_name): Do not set error.
* src/sfnt/sfdriver.c (get_win_string, get_apple_string): Ditto.
* src/cff/cffobjs.c (cff_strcpy): Do not confuse about error.
* src/psaux/psobjs.c (ps_table_done): Ditto.
* src/truetype/ttgxvar.c (ft_var_readpacked*, ft_var_load_avar): Ditto.
==========================
Tag sources with `VER-2-11-0'.
* docs/VERSION.TXT: Add entry for version 2.11.0.
* docs/CHANGES: Updated.
* README, src/base/ftver.rc, builds/windows/vc2010/index.html,
builds/windows/visualc/index.html,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/index.html, docs/freetype-config.1:
s/2.10.4/2.11.0/, s/2104/2110/.
* include/freetype/freetype.h (FREETYPE_MINOR): Set to 11.
(FREETYPE_PATCH): Set to 0.
* builds/unix/configure.raw (version_info): Set to 24:0:18.
* CMakeLists.txt (VERSION_MINOR): Set to 11.
(VERSION_PATCH): Set to 0.
* builds/toplevel.mk (dist): Ignore more git-related files.
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escCALLOTHERSUBR>: Convert assertion into error, since the
problem can happen with invalid user input.
Test case is file
fuzzing/corpora/legacy/oss-fuzz/5754332360212480-unknown-read
in the `freetype2-testing` repository.
Fixes timeout reported as
https://crbug.com/1206181
* src/psaux/psarrst.c (cf2_arrstack_{push,init}): Implement it.
* src/psaux/psarrst.h (CF2_ArrStackiRec): Drop `chunk'.
* include/freetype/internal/compiler-macros.h (FT_COMPARE_DEF):
Add new macro.
* src/base/ftrfork.c, src/bdf/bdflib.c, src/gxvalid/gxvcommn.c,
src/psaux/afmparse.c, src/psnames/psmodule.c, src/type1/t1afm.c,
src/sfnt/sfwoff.c, src/sfnt/sfwoff2.c: Update qsort callbacks.
Fixes#1026 when compiling FreeType with an unusual calling convention
while the C library qsort still expects cdecl.
This ensures good logging output, with all lines having a proper
prefix (if requested).
This is a continuation of a similar patch from 2020-12-02, which
missed some locations.
* include/freetype/internal/autohint.h
(FT_DECLARE_AUTOHINTER_INTERFACE): New macro.
* src/autofit/afmodule.h: Use it to declare
`af_autofitter_interface'.
* include/freetype/internal/ftobjs.h (FT_DECLARE_GLYPH): New macro.
* src/base/ftbase.h: Use it to declare `ft_bitmap_glyph_class' and
`ft_outline_glyph_class'.
* src/base/ftglyph.c: Include `ftbase.h'.
* src/cff/cffparse.c (cff_parser_run): Fix type of `t2_size'.
* src/pcf/pcfdrivr.c (pcf_cmap_char_next): Fix type of `result'.
* src/psaux/psauxmod.c (psaux_module_class): Use `FT_DEFINE_MODULE'.
* src/psaux/psauxmod.h: Declare `afm_parser_funcs',
`t1_cmap_classes', `cff_decoder_funcs', and `psaux_module_class'.
* src/pshinter/pshmod.c: Include `pshmod.h'.
* src/sfnt/sfwoff2.c (ROUND4, WRITE_SHORT): Fix implicit sign
conversion.
(compute_ULong_sum): Fix return type.
Fix implicit sign conversion.
(store_points): Fix type of `last_flag', `repeat_count', and `flag'.
Use casts to avoid warnings.
(reconstruct_glyf): Fix implicit sign conversion.
Use cast to avoid warning.
(get_x_mins): Fix implicit sign conversion.
* src/sfnt/ttcmap.c: Undef `TTCMAPCITEM'.
* src/sfnt/ttcmap.h: Define `TTCMAPCITEM' and include `ttcmapc.h' to
declare cmap classes.
* src/smooth/ftsmooth.c (ft_smooth_overlap_spans): Use cast.
* src/truetype/ttinterp.c (Ins_MIAP): Fix typo.
The following builds were failing due to previous changes:
make multi
make multi CC="c++"
* include/freetype/config/ftconfig.h: Remove `FT_END_HEADER'.
* include/freetype/config/ftheader.h (FT_BEGIN_HEADER,
FT_END_HEADER): Protect against redefinition.
* src/cache/ftccache.h, src/cache/ftcmru.h, src/pcf/pcfutil.h,
src/psaux/pserror.h, src/psaux/psft.h, src/psaux/psstack.h,
src/sfnt/woff2tags.h: Include `compiler-macros.h'.
* src/sfnt/woff2tags.c: Include `woff2tags.h'.
* src/psaux/t1decode.c (t1_decoder_parse_metrics): Copy
corresponding code from old engine's `t1_decoder_parse_charstrings'
function to handle `op_callsubr' and `op_return'.
We no longer have to take care of the 8.3 file name limit; this
allows us (a) to introduce longer, meaningful file names, and (b) to
avoid macro names in `#include' lines altogether since some
compilers (most notably Visual C++) doesn't support this properly.
*/*: Replace
#include FOO_H
with
#include <freetype/foo.h>
or something similar. Also update the documentation.
These have not been used in a very, very long time, so better remove
them. A corresponding patch will be submitted to the
`freetype2-demos' repository.
* src/Jamfile, src/*/Jamfile, Jamrules: Delete.
* src/base/ftoutln.c (FT_Outline_Transform): Bail on empty points.
* src/cff/cffload.c (cff_subfont_load): Use `FT_OFFSET'.
* src/psaux/psft.c (cf2_decoder_parse_substrings): Early out if
`charstring_base' or `charstring_len' are null.
* src/sfnt/ttload.c (tt_face_load_name): Use `FT_OFFSET'.
Ben Wagner