Commit 764bc8e41c19dac021e4ffe6ec6a207ed09df69a
2023-03-15T23:18:18
[truetype] Clean up glyph loading. * src/truetype/ttgload.c (TT_Load_Simple_Glyph): Clean space checking. (TT_Hint_Glyph): Don't copy the outline structure. (TT_Process_Simple_Glyph): Cosmetic update.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 92fe821..b7710f2 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -372,7 +372,6 @@
FT_Vector *vec, *vec_limit;
FT_Pos x, y;
FT_Short *cont, *cont_limit, last;
- FT_Int xy_size = 0;
/* check that we can add the contours to the glyph */
@@ -408,11 +407,19 @@
if ( error )
goto Fail;
- /* stace checked above */
+ /* space checked above */
n_ins = FT_NEXT_USHORT( p );
FT_TRACE5(( " Instructions size: %u\n", n_ins ));
+ /* check instructions size */
+ if ( p + n_ins > limit )
+ {
+ FT_TRACE1(( "TT_Load_Simple_Glyph: excessive instruction count\n" ));
+ error = FT_THROW( Too_Many_Hints );
+ goto Fail;
+ }
+
#ifdef TT_USE_BYTECODE_INTERPRETER
if ( IS_HINTED( load->load_flags ) )
@@ -421,14 +428,6 @@
FT_Memory memory = exec->memory;
- /* check instructions size */
- if ( ( limit - p ) < n_ins )
- {
- FT_TRACE1(( "TT_Load_Simple_Glyph: instruction count mismatch\n" ));
- error = FT_THROW( Too_Many_Hints );
- goto Fail;
- }
-
if ( exec->glyphSize )
FT_FREE( exec->glyphIns );
exec->glyphSize = 0;
@@ -487,9 +486,6 @@
flag = (FT_Byte*)outline->tags;
x = 0;
- if ( p + xy_size > limit )
- goto Invalid_Outline;
-
for ( ; vec < vec_limit; vec++, flag++ )
{
FT_Pos delta = 0;
@@ -858,9 +854,6 @@
{
FT_Error error;
- FT_GlyphLoader gloader = loader->gloader;
- FT_Outline current_outline = gloader->current.outline;
-
TT_Set_CodeRange( exec, tt_coderange_glyph, exec->glyphIns, n_ins );
@@ -872,7 +865,7 @@
return error;
/* store drop-out mode in bits 5-7; set bit 2 also as a marker */
- current_outline.tags[0] |=
+ loader->gloader->current.outline.tags[0] |=
( exec->GS.scan_type << 5 ) | FT_CURVE_TAG_HAS_SCANMODE;
}
@@ -922,10 +915,10 @@
static FT_Error
TT_Process_Simple_Glyph( TT_Loader loader )
{
- FT_GlyphLoader gloader = loader->gloader;
- FT_Error error = FT_Err_Ok;
- FT_Outline* outline;
- FT_Int n_points;
+ FT_Error error = FT_Err_Ok;
+ FT_GlyphLoader gloader = loader->gloader;
+ FT_Outline* outline = &gloader->current.outline;
+ FT_Int n_points = outline->n_points;
#ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
FT_Memory memory = loader->face->root.memory;
@@ -933,11 +926,7 @@
#endif
- outline = &gloader->current.outline;
- n_points = outline->n_points;
-
/* set phantom points */
-
outline->points[n_points ] = loader->pp1;
outline->points[n_points + 1] = loader->pp2;
outline->points[n_points + 2] = loader->pp3;