Commit c4fe77c3f072fab930267f95510562e7aeb03302

Ben Wagner 2023-04-17T11:17:16

[truetype] tt_size_reset_height to take FT_Size The `MetricsVariations` `FT_Size_Reset_Func` is defined to take an `FT_Size`. Because `tt_size_reset_height` is to be used as such a function, it must also take an `FT_Size` instead of a `TT_Size`. Even though the pointers passed will be the same at runtime, calling a function through a pointer of a different type from the original function pointer type is undefined behavior. This may be caught at runtime by Control Flow Integrity with something like clang's `cfi-icall`. Issue: https://crbug.com/1433651 * src/truetype/ttobjs.h (tt_size_reset_height): take `FT_Size` * src/truetype/ttobjs.c (tt_size_reset_height): take `FT_Size` and update documentation

diff --git a/src/truetype/ttobjs.c b/src/truetype/ttobjs.c
index ee4f3de..c351e08 100644
--- a/src/truetype/ttobjs.c
+++ b/src/truetype/ttobjs.c
@@ -1346,12 +1346,16 @@
    *   Used for variation fonts as an iterator function.
    *
    * @Input:
-   *   size ::
-   *     A handle to the target size object.
+   *   ft_size ::
+   *     A handle to the target TT_Size object. This function will be called
+   *     through a `FT_Size_Reset_Func` pointer which takes `FT_Size`. This
+   *     function must take `FT_Size` as a result. The passed `FT_Size` is
+   *     expected to point to a `TT_Size`.
    */
   FT_LOCAL_DEF( FT_Error )
-  tt_size_reset_height( TT_Size  size )
+  tt_size_reset_height( FT_Size  ft_size )
   {
+    TT_Size           size         = (TT_Size)ft_size;
     TT_Face           face         = (TT_Face)size->root.face;
     FT_Size_Metrics*  size_metrics = &size->hinted_metrics;
 
@@ -1408,7 +1412,7 @@
     FT_Size_Metrics*  size_metrics = &size->hinted_metrics;
 
 
-    error = tt_size_reset_height( size );
+    error = tt_size_reset_height( (FT_Size)size );
     if ( error )
       return error;
 
diff --git a/src/truetype/ttobjs.h b/src/truetype/ttobjs.h
index d74264e..d1834c0 100644
--- a/src/truetype/ttobjs.h
+++ b/src/truetype/ttobjs.h
@@ -391,7 +391,7 @@ FT_BEGIN_HEADER
 #endif /* TT_USE_BYTECODE_INTERPRETER */
 
   FT_LOCAL( FT_Error )
-  tt_size_reset_height( TT_Size  size );
+  tt_size_reset_height( FT_Size  size );
 
   FT_LOCAL( FT_Error )
   tt_size_reset( TT_Size  size );