Commit Graph

3518 Commits

Author SHA1 Message Date
Werner Lemberg
0af21dcf13 * src/cid/cidload.c (cid_parse_dict): Check `[FG]DBytes' size. 2015-10-17 09:29:52 +02:00
Werner Lemberg
0ba98da472 * src/cid/cidgload.c (cid_glyph_load): Check file offsets (#46222). 2015-10-17 09:11:02 +02:00
Werner Lemberg
8edfcbed53 [psaux] Fix heap buffer overflow (#46221).
* src/psaux/t1decode.c (t1_decoder_parse_charstring) <operator 12>:
Fix limit check.
2015-10-17 08:11:16 +02:00
Werner Lemberg
a5ecfb4ce6 * src/cid/cidload.c (cid_parse_dict): Handle invalid input (#46220). 2015-10-17 06:15:55 +02:00
Kostya Serebryany
266976b163 add src/tools/ftfuzzer/README 2015-10-15 22:15:53 -07:00
Bungeman
65d8980491 [bdf] Fix memory leak (#46213).
* src/bdf/bdflib.c (bdf_load_font): Always go to label `Fail' in
case of error.
2015-10-15 23:50:16 +02:00
Werner Lemberg
24a1fcdfce [truetype] Add TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES (#46208).
* devel/ftoption.h, include/freetype/config/ftoption.h
(TT_CONFIG_OPTION_MAX_RUNNABLE_OPCODES): New configuration macro.

* src/truetype/ttinterp.c (MAX_RUNNABLE_OPCODES): Removed.
(TT_RunIns): Updated.
2015-10-15 21:50:15 +02:00
Werner Lemberg
837ad9d411 * src/truetype/ttinterp.c (TT_RunIns): Fix bytecode stack tracing.
The used indices were off by 1.
2015-10-15 21:15:45 +02:00
Werner Lemberg
8b76eaf092 * src/tools/ftfuzzer/ftfuzzer.cc: Handle fixed sizes (#46211). 2015-10-15 18:28:43 +02:00
Werner Lemberg
e03214e166 [base] Compute MD5 checksums only if explicitly requested.
This improves profiling accuracy.

* src/base/ftobjs.c (FT_Render_Glyph_Internal): Implement it.
2015-10-15 16:58:13 +02:00
Werner Lemberg
2a20c92c4b [base] Use `FT_' namespace for MD5 functions (#42366).
* src/base/ftobjs.c (MD5_*): Define as `FT_MD5_*'.
Undefine HAVE_OPENSSL.
2015-10-14 15:23:15 +02:00
Werner Lemberg
8539915d18 [type1] Correctly handle missing MM axis names (#46202).
* src/type1/t1load.c (T1_Get_MM_Var): Implement it.
2015-10-13 20:43:19 +02:00
Werner Lemberg
58b61b6e05 [pcf] Quickly exit if font index < 0.
Similar to other font formats, this commit makes the parser no
longer check the whole PCF file but only the header and the TOC if
we just want to get the number of available faces (and a proper
recognition of the font format).

* src/pcf/pcfdrivr.c (PCF_Face_Init): Updated.
Exit quickly if face_index < 0.

* src/pcfread.c (pcf_load_font): Add `face_index' argument.
Exit quickly if face_index < 0.

* src/pcf/pcf.h: Updated.
2015-10-13 18:26:18 +02:00
Werner Lemberg
bdb56bba86 [ftfuzzer] Handle TTCs and MM/GX variations.
This patch also contains various other improvements.

* src/tools/ftfuzzer/ftfuzzer.cc: Add preprocessor guard to reject
pre-C++11 compilers.
(FT_Global): New class.  Use it to provide a global constructor and
destructor for the `FT_Library' object.
(setIntermediateAxis): New function to select an (arbitrary)
instance.
(LLVMFuzzerTestOneInput): Loop over all faces and named instances.
Also call `FT_Set_Char_Size'.
2015-10-13 11:51:13 +02:00
Werner Lemberg
43a96eb26f [truetype] Refine some GX sanity tests.
Use the `gvar' table size instead of the remaining bytes in the
stream.

* src/truetype/ttgxvar.h (GX_BlendRec): New field `gvar_size'.

* src/truetype/ttgxvar.c (ft_var_load_gvar): Set `gvar_size'.
(ft_var_readpackedpoints, ft_var_readpackeddeltas: New argument
`size'.
(tt_face_vary_cvt, TT_Vary_Apply_Glyph_Deltas): Updated.
2015-10-13 11:18:55 +02:00
Werner Lemberg
052f6c5649 [truetype] Another GX sanity test.
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Check
`tupleCount'.
Add tracing message.
2015-10-13 08:24:32 +02:00
Werner Lemberg
7ef0d8661a [truetype] Fix memory leak for broken GX fonts (#46188).
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Fix scope of
deallocation.
2015-10-13 08:14:20 +02:00
Werner Lemberg
f96094eef0 [truetype] Fix commit from 2015-10-10.
* src/truetype/ttgxvar.c (ft_var_load_gvar): Add missing error
handling body to condition.
2015-10-13 07:13:56 +02:00
Werner Lemberg
b9880aa0f8 [unix] Make MKDIR_P actually work.
* builds/unix/configure.raw: Fix underquoting of `INSTALL' and
`MKDIR_P'.

Problem reported by Dan Liddell <lddll@yahoo.com>.
2015-10-12 10:13:26 +02:00
Werner Lemberg
4f7f6f6e47 [sfnt] Improve extraction of number of named instances.
* src/sfnt/sfobjs.c (sfnt_init_face)
[TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Check number of instances against
`fvar' table size.
2015-10-11 07:55:25 +02:00
Werner Lemberg
a724dcf5c3 Split off ChangeLog.25. 2015-10-11 05:50:07 +02:00
Alexei Podtelezhnikov
c14ae9c5fd * src/base/ftoutln.c (FT_Outline_Get_Orientation): Fix overflow (#46149). 2015-10-10 22:28:26 -04:00
Werner Lemberg
8de39a7919 [sfnt] Fix infinite loops with broken cmaps (#46167).
* src/sfnt/ttcmap.c (tt_cmap8_char_next, tt_cmap12_next): Take care
of border condidions (i.e., if the loops exit naturally).
2015-10-10 13:34:11 +02:00
Werner Lemberg
da34673e54 [truetype] More sanity tests for GX handling.
These tests should mainly help avoid unnecessarily large memory
allocations in case of malformed fonts.

* src/truetype/ttgxvar.c (ft_var_readpackedpoints,
ft_var_readpackeddeltas): Check number of points against stream
size.
(ft_var_load_avar): Check `pairCount' against table length.
(ft_var_load_gvar): Check `globalCoordCount' and `glyphCount'
against table length.
(tt_face_vary_cvt): Check `tupleCount' and `offsetToData'.
Fix trace.
(TT_Vary_Apply_Glyph_Deltas): Fix trace.
Free `sharedpoints' to avoid memory leak.
2015-10-10 10:21:27 +02:00
Werner Lemberg
c220d8b498 [truetype] Better protection against malformed GX data (#46166).
* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Correctly
handle empty `localpoints' array.
2015-10-10 08:13:04 +02:00
Werner Lemberg
d353f6e012 * src/pcf/pcfread.c (pcf_read_TOC): Check stream size (#46162). 2015-10-10 06:54:46 +02:00
Werner Lemberg
c12956e700 * src/gzip/ftgzip.c (FT_Stream_OpenGzip): Use real stream size. 2015-10-09 09:38:32 +02:00
Werner Lemberg
d98053c997 [pcf] Protect against invalid number of TOC entries (#46159).
* src/pcf/pcfread.c (pcf_read_TOC): Check number of TOC entries
against size of data stream.
2015-10-08 23:17:41 +02:00
Werner Lemberg
06c2d3324e [type42] Protect against invalid number of glyphs (#46159).
* src/type42/t42parse.c (t42_parse_charstrings): Check number of
`CharStrings' dictionary entries against size of data stream.
2015-10-08 21:31:57 +02:00
Werner Lemberg
983b00ec86 [sfnt] Fix some signed overflows (#46149).
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
<TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
2015-10-08 18:44:45 +02:00
Werner Lemberg
121122416d [type1] Protect against invalid number of subroutines (#46150).
* src/type1/t1load.c (parse_subrs): Check number of
`Subrs' dictionary entries against size of data stream.
2015-10-08 08:55:15 +02:00
Kostya Serebryany
dde84f2539 [ftfuzzer] Add support for LLVM's LibFuzzer.
* src/tools/ftfuzzer/ftfuzzer.cc, src/tools/runinput.cc: New files.
2015-10-07 22:18:22 +02:00
Alexei Podtelezhnikov
6eb6158dd7 [smooth] Faster alternative line renderer.
This implementation renders the entire line segment at once without
subdividing it into scanlines.  The main speed improvement comes from
reducing the number of divisions to just two per line segment, which
is a bare minimum to calculate cell coverage in a smooth rasterizer.
Notably, the progression from cell to cell does not itself require any
divisions at all.  The speed improvement is more noticeable at larger
sizes.

* src/smooth/ftgrays.c (gray_render_line): New implementation.
2015-10-06 22:39:54 -04:00
Werner Lemberg
066a49139b [cff] Return correct PS names from pure CFF (#46130).
* src/cff/cffdrivr.c (cff_get_ps_name): Use SFNT service only for
SFNT.
2015-10-06 07:55:32 +02:00
Werner Lemberg
30fe5e762e [base] Replace left shifts with multiplication (#46118).
* src/base/ftglyph.c (ft_bitmap_glyph_bbox, FT_Get_Glyph): Do it.
2015-10-04 13:08:08 +02:00
Werner Lemberg
8cabd919ca * Version 2.6.1 released.
=========================

Tag sources with `VER-2-6-1'.

* docs/VERSION.DLL: Update documentation and bump version number to
2.6.1.

* README, Jamfile (RefDoc), builds/windows/vc2005/freetype.vcproj,
builds/windows/vc2005/index.html,
builds/windows/vc2008/freetype.vcproj,
builds/windows/vc2008/index.html,
builds/windows/vc2010/freetype.vcxproj,
builds/windows/vc2010/index.html,
builds/windows/visualc/freetype.dsp,
builds/windows/visualc/freetype.vcproj,
builds/windows/visualc/index.html,
builds/windows/visualce/freetype.dsp,
builds/windows/visualce/freetype.vcproj,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/freetype.vcproj,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/freetype.vcproj,
builds/wince/vc2008-ce/index.html: s/2.6/2.6.1/, s/26/261/.

* include/freetype/freetype.h (FREETYPE_PATCH): Set to 1.

* builds/unix/configure.raw (version_info): Set to 18:1:12.
* CMakeLists.txt (VERSION_PATCH): Set to 1.

* src/autofit/afmodule.c [AF_DEBUG_AUTOFIT]: Ensure C linking for
dumping functions.
2015-10-04 08:18:01 +02:00
Werner Lemberg
b260dc9fab [bzip2, gzip] Avoid access of unitialized memory (#46109).
* src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c
(ft_gzip_file_fill_input): In case of an error, adjust the limit to
avoid copying uninitialized memory.
2015-10-04 07:39:22 +02:00
Werner Lemberg
53838ce016 [bzip2, gzip] Avoid access of unitialized memory (#46109).
* src/bzip2/ftbzip2.c (ft_bzip2_file_fill_output), src/gzip/ftgzip.c
(ft_gzip_file_fill_output): In case of an error, adjust the limit to
avoid copying uninitialized memory.
2015-10-03 21:12:25 +02:00
Alexei Podtelezhnikov
e2dae8fead [smooth] Clean up worker.
* src/smooth/ftgrays.c (gray_TWorker): Remove never used fields.
2015-10-01 22:03:34 -04:00
Werner Lemberg
90e437e3cd [sfnt] Make `tt_cmap4_char_map_linear' more robust (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Take care of
border conditions (i.e., if the loop exits naturally).
2015-10-01 20:00:27 +02:00
Werner Lemberg
fab67b85ec * src/autofit/afranges.c (af_deva_nonbase_uniranges): Fix ranges.
They should be a subset of `af_deva_uniranges'.
2015-10-01 16:47:05 +02:00
Werner Lemberg
5f8f44d218 [sfnt] Make `tt_cmap4_char_map_linear' faster (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Use inner loop to
reject too large glyph indices.
2015-10-01 14:16:03 +02:00
Alexei Podtelezhnikov
8bbcfb2c2f [smooth] Clean up worker.
* src/smooth/ftgrays.c (gray_TWorker): Remove lightly used `last_ey'.
(gray_start_cell, gray_render_line): Update.
2015-09-30 23:08:53 -04:00
Werner Lemberg
dbd04269dc [autofit] Replace no-base' with non-base'.
* src/autofit/*: Do it.
2015-09-30 17:52:42 +02:00
Werner Lemberg
2ff83a5c99 [sfnt] Rewrite `tt_cmap4_char_map_linear' (#46078).
* src/sfnt/ttcmap.c (tt_cmap4_char_map_linear): Add code to better
skip invalid segments.
If searching the next character, provide a more efficient logic to
speed up the code.
2015-09-30 14:44:29 +02:00
Werner Lemberg
8651f37ad5 [truetype] Adjust number of glyphs for malformed `loca' tables.
* src/truetype/ttpload.c (tt_face_load_loca): Implement it.
2015-09-30 10:26:10 +02:00
Werner Lemberg
483007fcd9 [pshinter] Avoid harmless overflow (#45984).
* src/pshinter/pshglob.c (psh_blues_set_zones): Fix it.
2015-09-29 11:22:15 +02:00
Werner Lemberg
a3046567bc [autofit] Add support for Lao script.
Thanks to Danh Hong <danhhong@gmail.com> for guidance with blue zone
characters!

* src/autofit/afblue.dat: Add blue zone data for Lao.

* src/autofit/afblue.c, src/autofit/afblue.h: Regenerated.

* src/autofit/afscript.h: Add Lao standard characters.

* src/autofit/afranges.c: Add Lao data.

* src/autofit/afstyles.h: Add Lao data.
2015-09-28 09:45:56 +02:00
suzuki toshiya
fb5268cf7b [base] Fix a leak by broken sfnt-PS or resource fork (#46028).
open_face_from_buffer() frees passed buffer if valid font
is not found.  But if copying to the buffer is failed,
the allocated buffer should be freed within the caller.

* src/base/ftobjs.c (open_face_PS_from_sfnt_stream): Free
the buffer `sfnt_ps' if an error caused before calling
open_face_from_buffer().
(Mac_Read_sfnt_Resource): Free the buffer `sfnt_data' if
an error caused before calling open_face_from_buffer();
2015-09-28 02:01:43 +09:00
suzuki toshiya
8a05d250df [mac] Fix buffer size calculation for LWFN font.
* src/base/ftmac.c (read_lwfn): Cast post_size to FT_ULong
to prevent confused copy by too large chunk size.
2015-09-28 01:40:21 +09:00