Commit Graph

3494 Commits

Author SHA1 Message Date
Werner Lemberg c220d8b498 [truetype] Better protection against malformed GX data (#46166).
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Correctly
handle empty `localpoints' array.
2015-10-10 08:13:04 +02:00
Werner Lemberg d353f6e012 * src/pcf/pcfread.c (pcf_read_TOC): Check stream size (#46162). 2015-10-10 06:54:46 +02:00
Werner Lemberg c12956e700 * src/gzip/ftgzip.c (FT_Stream_OpenGzip): Use real stream size. 2015-10-09 09:38:32 +02:00
Werner Lemberg d98053c997 [pcf] Protect against invalid number of TOC entries (#46159).
* src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
against size of data stream.
2015-10-08 23:17:41 +02:00
Werner Lemberg 06c2d3324e [type42] Protect against invalid number of glyphs (#46159).
* src/type42/t42parse.c (t42_parse_charstrings): Check number of
`CharStrings' dictionary entries against size of data stream.
2015-10-08 21:31:57 +02:00
Werner Lemberg 983b00ec86 [sfnt] Fix some signed overflows (#46149).
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
<TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
2015-10-08 18:44:45 +02:00
Werner Lemberg 121122416d [type1] Protect against invalid number of subroutines (#46150).
* src/type1/t1load.c (parse_subrs): Check number of
`Subrs' dictionary entries against size of data stream.
2015-10-08 08:55:15 +02:00
Kostya Serebryany dde84f2539 [ftfuzzer] Add support for LLVM's LibFuzzer.
* src/tools/ftfuzzer/ftfuzzer.cc, src/tools/runinput.cc: New files.
2015-10-07 22:18:22 +02:00
Alexei Podtelezhnikov 6eb6158dd7 [smooth] Faster alternative line renderer.
This implementation renders the entire line segment at once without
subdividing it into scanlines.  The main speed improvement comes from
reducing the number of divisions to just two per line segment, which
is a bare minimum to calculate cell coverage in a smooth rasterizer.
Notably, the progression from cell to cell does not itself require any
divisions at all.  The speed improvement is more noticeable at larger
sizes.

* src/smooth/ftgrays.c (gray_render_line): New implementation.
2015-10-06 22:39:54 -04:00
Werner Lemberg 066a49139b [cff] Return correct PS names from pure CFF (#46130).
* src/cff/cffdrivr.c (cff_get_ps_name): Use SFNT service only for
SFNT.
2015-10-06 07:55:32 +02:00
Werner Lemberg 30fe5e762e [base] Replace left shifts with multiplication (#46118).
* src/base/ftglyph.c (ft_bitmap_glyph_bbox, FT_Get_Glyph): Do it.
2015-10-04 13:08:08 +02:00
Werner Lemberg 8cabd919ca * Version 2.6.1 released.
=========================

Tag sources with `VER-2-6-1'.

* docs/VERSION.DLL: Update documentation and bump version number to
2.6.1.

* README, Jamfile (RefDoc), builds/windows/vc2005/freetype.vcproj,
builds/windows/vc2005/index.html,
builds/windows/vc2008/freetype.vcproj,
builds/windows/vc2008/index.html,
builds/windows/vc2010/freetype.vcxproj,
builds/windows/vc2010/index.html,
builds/windows/visualc/freetype.dsp,
builds/windows/visualc/freetype.vcproj,
builds/windows/visualc/index.html,
builds/windows/visualce/freetype.dsp,
builds/windows/visualce/freetype.vcproj,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/freetype.vcproj,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/freetype.vcproj,
builds/wince/vc2008-ce/index.html: s/2.6/2.6.1/, s/26/261/.

* include/freetype/freetype.h (FREETYPE_PATCH): Set to 1.

* builds/unix/configure.raw (version_info): Set to 18:1:12.
* CMakeLists.txt (VERSION_PATCH): Set to 1.

* src/autofit/afmodule.c [AF_DEBUG_AUTOFIT]: Ensure C linking for
dumping functions.
2015-10-04 08:18:01 +02:00
Werner Lemberg b260dc9fab [bzip2, gzip] Avoid access of unitialized memory (#46109).
* src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c
(ft_gzip_file_fill_input): In case of an error, adjust the limit to
avoid copying uninitialized memory.
2015-10-04 07:39:22 +02:00
Werner Lemberg 53838ce016 [bzip2, gzip] Avoid access of unitialized memory (#46109).
* src/bzip2/ftbzip2.c (ft_bzip2_file_fill_output), src/gzip/ftgzip.c
(ft_gzip_file_fill_output): In case of an error, adjust the limit to
avoid copying uninitialized memory.
2015-10-03 21:12:25 +02:00
Alexei Podtelezhnikov e2dae8fead [smooth] Clean up worker.
* src/smooth/ftgrays.c (gray_TWorker): Remove never used fields.
2015-10-01 22:03:34 -04:00
Werner Lemberg 90e437e3cd [sfnt] Make `tt_cmap4_char_map_linear' more robust (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Take care of
border conditions (i.e., if the loop exits naturally).
2015-10-01 20:00:27 +02:00
Werner Lemberg fab67b85ec * src/autofit/afranges.c (af_deva_nonbase_uniranges): Fix ranges.
They should be a subset of `af_deva_uniranges'.
2015-10-01 16:47:05 +02:00
Werner Lemberg 5f8f44d218 [sfnt] Make `tt_cmap4_char_map_linear' faster (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Use inner loop to
reject too large glyph indices.
2015-10-01 14:16:03 +02:00
Alexei Podtelezhnikov 8bbcfb2c2f [smooth] Clean up worker.
* src/smooth/ftgrays.c (gray_TWorker): Remove lightly used `last_ey'.
(gray_start_cell, gray_render_line): Update.
2015-09-30 23:08:53 -04:00
Werner Lemberg dbd04269dc [autofit] Replace `no-base' with `non-base'.
* src/autofit/*: Do it.
2015-09-30 17:52:42 +02:00
Werner Lemberg 2ff83a5c99 [sfnt] Rewrite `tt_cmap4_char_map_linear' (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Add code to better
skip invalid segments.
If searching the next character, provide a more efficient logic to
speed up the code.
2015-09-30 14:44:29 +02:00
Werner Lemberg 8651f37ad5 [truetype] Adjust number of glyphs for malformed `loca' tables.
* src/truetype/ttpload.c (tt_face_load_loca): Implement it.
2015-09-30 10:26:10 +02:00
Werner Lemberg 483007fcd9 [pshinter] Avoid harmless overflow (#45984).
* src/pshinter/pshglob.c (psh_blues_set_zones): Fix it.
2015-09-29 11:22:15 +02:00
Werner Lemberg a3046567bc [autofit] Add support for Lao script.
Thanks to Danh Hong <danhhong@gmail.com> for guidance with blue zone
characters!

* src/autofit/afblue.dat: Add blue zone data for Lao.

* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Lao standard characters.

* src/autofit/afranges.c: Add Lao data.

* src/autofit/afstyles.h: Add Lao data.
2015-09-28 09:45:56 +02:00
suzuki toshiya fb5268cf7b [base] Fix a leak by broken sfnt-PS or resource fork (#46028).
open_face_from_buffer() frees passed buffer if valid font
is not found.  But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();
2015-09-28 02:01:43 +09:00
suzuki toshiya 8a05d250df [mac] Fix buffer size calculation for LWFN font.
* src/base/ftmac.c (read_lwfn): Cast post_size to FT_ULong
to prevent confused copy by too large chunk size.
2015-09-28 01:40:21 +09:00
Alexei Podtelezhnikov 3dffe8ef16 Add ChangeLog entry. 2015-09-27 11:30:17 -04:00
Werner Lemberg 19188a9a19 [autofit] Minor tracing improvement.
* src/autofit/aflatin.c (af_latin_metrics_scale_dim): Don't emit
blue zones header line if there are no blue zones.
2015-09-26 16:57:17 +02:00
Werner Lemberg 4187753970 [bzip2, gzip, lzw] Harmonize function signatures with prototype.
Suggested by Hin-Tak Leung.

* src/bzip2/ftbzip2.c (ft_bzip2_stream_io), src/gzip/ftgzip.c
(ft_gzip_stream_io), src/lzw/ftlzw.c (ft_lzw_stream_io): Do it.
2015-09-26 15:19:54 +02:00
Hin-Tak Leung 265ade8e80 Add new FT_LOAD_COMPUTE_METRICS load flag.
* include/freetype/freetype.h (FT_LOAD_COMPUTE_METRICS): New macro.
* src/truetype/ttgload.c (compute_glyph_metrics): Usage.
2015-09-26 14:51:30 +02:00
Werner Lemberg d57f227121 * src/base/ftobjs.c (Mac_Read_sfnt_Resource): Add cast. 2015-09-26 08:44:26 +02:00
Werner Lemberg d7f456ee17 Formatting, minor comment corrections. 2015-09-26 08:37:14 +02:00
Werner Lemberg 2439c515a7 [type1] Protect against invalid number of glyphs (#46029).
* src/type1/t1load.c (parse_charstrings): Check number of
`CharStrings' dictionary entries against size of data stream.
2015-09-25 16:54:28 +02:00
Werner Lemberg 5339c75ee6 [sfnt] Better checks for invalid cmaps (2/2) (#46019).
While the current code in `FT_Get_Next_Char' correctly rejects
out-of-bounds glyph indices, it can be extremely slow for malformed
cmaps that use 32bit values.  This commit tries to improve that.

* src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next,
tt_cmap12_char_map_binary, tt_cmap13_next,
tt_cmap13_char_map_binary): Reject glyph indices larger than or
equal to the number of glyphs.
2015-09-24 13:39:44 +02:00
Werner Lemberg c409eb18ae [base, sfnt] Better checks for invalid cmaps (1/2).
* src/base/ftobjs.c (FT_Get_Char_Index): Don't return out-of-bounds
glyph indices.
(FT_Get_First_Char): Updated.

* src/sfnt/ttcmap.c (tt_cmap6_char_next): Don't return character
codes greater than 0xFFFF.

(tt_cmap8_char_index): Avoid integer overflow in computation of
glyph index.
(tt_cmap8_char_next): Avoid integer overflows in computation of
both next character code and glyph index.

(tt_cmap10_char_index): Fix unsigned integer logic.
(tt_cmap10_char_next): Avoid integer overflow in computation of
next character code.

(tt_cmap12_next): Avoid integer overflows in computation of both
next character code and glyph index.
(tt_cmap12_char_map_binary): Ditto.
(tt_cmap12_char_next): Simplify.

(tt_cmap13_char_map_binary): Avoid integer overflow in computation
of next character code.
(tt_cmap13_char_next): Simplify.
2015-09-24 12:39:38 +02:00
suzuki toshiya e982f5b78a [base] Check too long POST and sfnt resource (#45919).
* src/base/ftbase.h (FT_MAC_RFORK_MAX_LEN): Maximum length
of the resource fork for Mac OS.  The resource fork larger
than 16 MB can be written but could not be handled
correctly, at least in Carbon routine.
See https://support.microsoft.com/en-us/kb/130437

* src/base/ftobjs.c (Mac_Read_POST_Resource): No need `0x'
for `%p' formatter.

* src/base/ftbase.c (Mac_Read_POST_Resource): Check the
fragment and total size of the concatenated POST resource
before buffer allocation.
(Mac_Read_sfnt_Resource): Check the declared size of
sfnt resource before buffer allocation.

* src/base/ftmac.c (read_lwfn, FT_New_Face_From_SFNT):
Check the total resource size before buffer allocation.
2015-09-21 23:12:09 +09:00
Werner Lemberg 730b6d7468 [sfnt] Improve handling of invalid SFNT table entries (#45987).
This patch fixes weaknesses in function `tt_face_load_font_dir'.

- It incorrectly assumed that valid tables are always at the
  beginning.  As a consequence, some valid tables after invalid
  entries (which are ignored) were never seen.

- Duplicate table entries (this is, having the same tag) were not
  rejected.

- The number of valid tables was sometimes too large, leading to
  access of invalid tables.

* src/sfnt/ttload.c (check_table_dir): Add argument to return number
of valid tables.
Add another tracing message.
(tt_face_load_font_dir): Only allocate table array for valid
entries as returned by `check_table_dir'.
Reject duplicate tables and adjust number of valid tables
accordingly.
2015-09-19 12:41:12 +02:00
Werner Lemberg cb7a5122e1 [pcf] Improve `FT_ABS' fix from 2015-09-17 (#45999).
* src/pcf/pcfread.c (pcf_load_font): Do first the cast to FT_Short,
then take the absolute value.
Also apply FT_ABS to `height'.
2015-09-19 07:58:03 +02:00
Werner Lemberg f28c95c4a4 [type42] Fix memory leak (#45989).
* src/type42/t42parse.c (t42_parse_charstrings): Allow only a single
`CharStrings' array.
2015-09-17 19:30:26 +02:00
Werner Lemberg 4942c2bb72 [psaux] Fix memory leak (#45986).
* src/psaux/psobjs.c (ps_parser_load_field) <T1_FIELD_TYPE_MM_BBOX>:
Free `temp' in case of error.
2015-09-17 17:56:53 +02:00
Werner Lemberg 7d364b7e51 [psaux] Improve tracing message.
* src/psaux/psobjs.c (ps_parser_load_field) <T1_FIELD_TYPE_MM_BBOX>:
Handle plural correctly.
2015-09-17 16:31:58 +02:00
Werner Lemberg c838c4f7b5 [pcf] Fix integer overflows (#45985).
* src/pcf/pcfread.c (pcf_load_font): Use FT_MulDiv.
2015-09-17 16:22:40 +02:00
Werner Lemberg 9db9adda0f [pcf] Use FT_ABS for some property values (#45893).
* src/pcf/pcfread.c (pcf_load_font): Take absolute values for
AVERAGE_WIDTH, POINT_SIZE, PIXEL_SIZE, RESOLUTION_X, and
RESOLUTION_Y.  In tracing mode, add warnings.
2015-09-17 13:42:59 +02:00
Werner Lemberg bd0438a461 Minor fixes for some clang warnings.
* src/base/ftoutln.c (FT_Outline_EmboldenXY): Cast, possible missing
initialization.

* src/truetype/ttgload.c (TT_Process_Composite_Component): Cast.
2015-09-16 18:05:43 +02:00
Werner Lemberg 19cb1127d4 [type1, type42] Fix memory leaks (#45966).
* src/type1/t1load.c (parse_blend_axis_types): Handle multiple axis
names.
(parse_blend_design_map): Allow only a single design map.
(parse_encoding): Handle multiple encoding vectors.

* src/type42/t42parse.c (t42_parse_encoding): Handle multiple
encoding vectors.
2015-09-15 08:52:36 +02:00
Werner Lemberg 7f0f40116d [truetype] Fix integer type (#45965).
* src/truetype/ttobjs.c (tt_synth_sfnt_checksum): Implement it.
2015-09-15 07:23:53 +02:00
Werner Lemberg 577daf1c30 * src/pcf/pcfread.c (pcf_load_font): Fix integer overflow (#45964). 2015-09-15 07:10:16 +02:00
Werner Lemberg 581c7e2a51 [type1, type42] Check encoding array size (#45961).
* src/type1/t1load.c (parse_encoding), src/type42/t42parse.c
(t42_parse_encoding): Do it.
2015-09-15 06:49:06 +02:00
Alexei Podtelezhnikov 3ea0d2c65a * src/base/ftcalc.c (FT_MulFix) [FT_LONG64]: Improve. 2015-09-13 23:19:34 -04:00
Werner Lemberg 7962a15d64 [type1] Fix another potential buffer overflow (#45955).
* src/type1/t1parse (T1_Get_Private_Dict): Assure that check for
`eexec' doesn't exceed `limit'.
2015-09-14 00:38:26 +02:00