AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[sfnt, truetype] Minor adjustments for OpenType 1.8.2.

Browse Source 
* src/sfnt/sfobjs.c (sfnt_load_face): The units per EM value has now
(tighter) limits.

* src/truetype/ttgload.c (load_truetype_glyph): The new OpenType
version explicitly allows all negative values for the number of
contours if we have a composite glyph (this is for better backwards
compatibility I guess), but it still recommends value -1.
This commit is contained in:
Werner Lemberg 2017-08-01 08:24:51 +02:00
parent 933f4cbe79
commit ce367774d2
3 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
2017-08-01 Werner Lemberg <wl@gnu.org>
[sfnt, truetype] Minor adjustments for OpenType 1.8.2.
* src/sfnt/sfobjs.c (sfnt_load_face): The units per EM value has now
(tighter) limits.
* src/truetype/ttgload.c (load_truetype_glyph): The new OpenType
version explicitly allows all negative values for the number of
contours if we have a composite glyph (this is for better backwards
compatibility I guess), but it still recommends value -1.
2017-07-26 Werner Lemberg <wl@gnu.org>
[cff] Integer overflow.

5
src/sfnt/sfobjs.c
View File

@ -1224,7 +1224,10 @@
goto Exit;
}
if ( face->header.Units_Per_EM == 0 )
/* OpenType 1.8.2 introduced limits to this value; */
/* however, they make sense for older SFNT fonts also */
if ( face->header.Units_Per_EM < 16 ||
face->header.Units_Per_EM > 16384 )
{
error = FT_THROW( Invalid_Table );

11
src/truetype/ttgload.c
View File

@ -1686,7 +1686,7 @@
/***********************************************************************/
/* otherwise, load a composite! */
else if ( loader->n_contours == -1 )
else if ( loader->n_contours < 0 )
{
FT_Memory memory = face->root.memory;
@ -1697,6 +1697,9 @@
FT_ListNode node, node2;
/* normalize the `n_contours' value */
loader->n_contours = -1;
/*
* We store the glyph index directly in the `node->data' pointer,
* following the glib solution (cf. macro `GUINT_TO_POINTER') with a
@ -1991,12 +1994,6 @@
}
}
}
else
{
/* invalid composite count (negative but not -1) */
error = FT_THROW( Invalid_Outline );
goto Exit;
}
/***********************************************************************/
/***********************************************************************/