|
034e5dbf
|
2022-02-22T20:37:43
|
|
[psaux] Full bounds check for OtherSubr 19.
It is possible for OtherSubr 19 to be invoked when `decoder->buildchar` is
NULL (so that `decoder->len_buildchar` is 0), the `blend` is non-NULL with
`blend->num_designs` set to 2, and the user supplied `idx` to be large (for
example 0xFFFFFFFE). Since these are all `FT_UInt32` the existing bounds
check overflows in a well defined manner, allowing for an invalid call to
`memcpy`.
In addition, it is possible to call OtherSubr 19 with
`decoder->len_buildchar`, `blend->num_designs`, and `idx` all zero (implying
that `blend->weight_vector` and `decoder->buildchar` are NULL). This passes
the bounds check (it is logically always fine to copy nothing starting at
index zero) but may invoke undefined behavior in `ft_memcpy` if it is backed
by `memcpy`. Calling `memcpy` with either the `src` or `dst` NULL is
undefined behavior (even if `count` is zero).
* src/psaux/psintrp.c (cf2_interpT2CharString): Correctly check that
`blend->num_designs` can be copied to `decoder->buildchar[idx]`.
Also avoid passing NULL to `ft_memcpy`.
Bug: https://crbug.com/1299259
|
|
77bd46e9
|
2021-10-10T23:12:12
|
|
[psaux] Signedness revisions.
Unsigned indexes are easier to check.
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings): Updated.
* src/psaux/psintrp.c (cf2_interpT2CharString): Ditto.
* src/psaux/t1decode.c (t1_decoder_parse_charstrings): Ditto.
* src/type1/t1load.c (read_binary_data): Ditto.
|
|
c2fa51d9
|
2021-07-24T20:32:16
|
|
Fix some `cppcheck` warnings.
* src/bzip2/ftbzip2.c (ft_bzip2_file_skip_output), src/gzip/ftgzip.c
(ft_gzip_file_skip_output): Reduce scope of `delta`.
* src/psaux/psintrp.c, src/psaux/psintrp.h (cf2_interpT2CharString): Add
`const` to `buf` parameter.
* src/raster/ftraster.c (DelOld): Add `const` to `profile` parameter.
(Vertical_Sweep_Span): Reduce scope of `target`.
(FT_Outline_Get_CBox): Reduce scope of `xMin`, `xMax`, `yMin`, `yMax`.
* src/smooth/ftgrays.c (gray_render_conic): Reduce scope of `split`.
(gray_sweep, gray_sweep_direct): Reduce scope of `area`.
* src/tools/apinames.c (names_dump) <OUTPUT_WATCOM_LBC>: Reduce scope of
`temp`.
|
|
db0f2c44
|
2021-06-12T10:05:07
|
|
[psaux] Fix another assertion.
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escCALLOTHERSUBR>: Convert assertion into error, since the
problem can happen with invalid user input.
Test case is file
fuzzing/corpora/legacy/oss-fuzz/5754332360212480-unknown-read
in the `freetype2-testing` repository.
|
|
272ae5ee
|
2020-12-07T10:29:24
|
|
* src/*: More fixes for using a '\n' in `FT_TRACE` and `FT_ERROR`.
|
|
e1339133
|
2020-06-08T13:31:55
|
|
Make macros for header file names optional.
We no longer have to take care of the 8.3 file name limit; this
allows us (a) to introduce longer, meaningful file names, and (b) to
avoid macro names in `#include' lines altogether since some
compilers (most notably Visual C++) doesn't support this properly.
*/*: Replace
#include FOO_H
with
#include <freetype/foo.h>
or something similar. Also update the documentation.
|
|
f2b64583
|
2019-07-04T14:04:52
|
|
[psaux] (1/2) Handle fonts that use SEAC for ligatures (#56580).
As originally intended, a Type 1 SEAC charstring would be used for
an accented glyph (like `acaron' or `uumlaut'), where the advance
width of the SEAC glyph is the same as that of the `base' glyph
(like `a' or `u'). In this case it is not uncommon for the SEAC
glyph to not use an (H)SBW opcode of its own but to rely on the
value from the base glyph.
However, out-of-spec fonts also use SEAC glyphs for ligatures (like
`oe' or `fi'), and in those cases the overall advance width is
greater than that of the `base' glyph. For this reason we have to
allow that the SEAC glyph can have an (H)SBW value of its own, and
if it has, retain this value, rather than the one from the base
glyph.
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_escSEAC>:
Implement it.
|
|
6a4718a3
|
2019-03-05T17:25:19
|
|
Fix use of uninitialized memory.
* src/psaux/psintrp.c (cf2_interpT2CharString): The call to
`cf2_arrstack_setCount' may fail because the allocator ran out of
memory. When this happens the stack is still written to before the
error condition is checked. This means that FreeType writes outside
of allocated memory. This commit moves the error check prior to the
stack assignment, hence the function now properly returns with an
error condition.
|
|
1e7a8f30
|
2019-01-08T20:54:13
|
|
[psaux, type1] Align tracing.
|
|
b75abeb5
|
2019-01-08T20:51:39
|
|
[psaux] Fix closepath (#55414).
All of the Type 1 path building is done with code common to the
revised CFF engine, with the exception of closepath, which was still
calling ps_builder_close_contour(), thus previously cached segments
were not always written to the path, and glyph corruption, or even
invalid outlines were possible.
* src/psauc/psinterp.c (cf2_interpT2CharString) <cf2_cmdCLOSEPATH>:
Switch to calling `cf2_glyphpath_closeOpenPath'.
|
|
a9af6914
|
2018-09-25T09:10:09
|
|
Fix handing of `FT_Bool'.
Before this commit we had code like
(FT_Bool)( globals->glyph_styles[gindex] & 0x8000)
Since `FT_Bool' is defined to be an `unsigned char', the code
evaluated to something like
(unsigned char)( 0x8532 & 0x8000)
which in turn expanded to
(unsigned char)( 0x8000)
and finally yielded 0x00 – i.e., false – not as expected.
Problem reported and analyzed by Tony Smith <tony.smith@macro4.com>.
* include/freetype/fttypes.h (FT_BOOL): Add a comparison against
zero so that we always have a Boolean expression.
*/*: Replace castings to `FT_Bool' with calls to `FT_BOOL' where
possible.
|
|
a0dd16fb
|
2018-08-15T18:13:17
|
|
Don't use `trace_' prefix for FT_COMPONENT arguments.
* include/freetype/internal/ftdebug.h (FT_TRACE_COMP,
FT_TRACE_COMP_): New auxiliary macros to add `trace_' prefix.
(FT_TRACE): Use `FT_TRACE_COMP'.
*/* (FT_COMPONENT): Updated.
|
|
1d7b034c
|
2018-08-14T15:48:17
|
|
Use formatting string in FT_TRACEX calls for non-simple arguments.
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_hstem, cff_op_hintmask, cff_op_hlineto, cff_op_vhcurveto>:
Do it.
* src/psaux/pshints.c (cf2_hintmap_build): Ditto.
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdHSTEM,
cf2_cmdVSTEM, cf2_cmdHLINETO, cf2_cmdRRCURVETO, cf2_cmdCALLSUBR,
cf2_escHSTEM3, cf2_cmdHINTMASK, cf2_cmdHVCURVETO>: Ditto.
* src/truetype/ttinterp.c (TT_RunIns): Ditto.
|
|
d277bfc9
|
2018-07-27T09:15:43
|
|
[psaux, type1]: More tracing improvements.
* src/psaux/psintrp.c (cf2_interpT2CharString): Trace skipped
outline commands.
* src/psaux/t1decode.c (t1_decoder_parse_charstring): Fix
missing case.
(t1_decoder_parse_metrics): Make tracing output more compact.
* src/type1/t1gload.c (T1_Compute_Max_Advance): Be less verbose.
(T1_Get_Advances): Add tracing.
|
|
78d85b9c
|
2018-06-04T18:42:29
|
|
Restore missing comment lines and other minor fixes
|
|
9ac9060d
|
2018-06-03T09:01:17
|
|
[GSoC] src/*.*: Convert block comments to `light' style.
This monster commit was created by applying Nikhil's scripts
`docconverter.py' and `markify.py' to all C header and source files,
followed up by minor manual clean-up.
No change in functionality, of course.
I used commit f7419907bc6044b9b7057f9789866426c804ba82 from
https://github.com/nikramakrishnan/freetype-docs.git.
|
|
cc2f3cde
|
2018-01-10T13:24:56
|
|
[psaux] Correctly handle Flex features (#52846).
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdVMOVETO,
cf2_cmdHMOVETO>: Do not move if doing Flex.
|
|
cdab9cfa
|
2017-10-21T16:36:49
|
|
[psaux] Fix PostScript interpreter rewinding in Type 1 mode. (#52251)
The interpreter in Type 1 mode rewinds the charstring after collecting
all hints for building the initial hintmap (commit d52dd7f). However,
some charstrings use `endchar' in a final subroutine call, rewinding to
the start of that subroutine, and only a small section of the actual
glyph is drawn.
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdENDCHAR>:
Ensure we are on the top level charstring before rewinding.
|
|
179caf5a
|
2017-10-01T01:39:27
|
|
[psaux] Formatting, minor fixes, whitespace, copyright notices.
|
|
ec7d2e5f
|
2017-09-28T14:21:34
|
|
* src/psaux/psintrp.c (cf2_doStems): Fix integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3510
|
|
4cdbac05
|
2017-09-25T09:05:00
|
|
Fix compiler warnings.
* src/psaux/psft.c (cf2_initLocalRegionBuffer): Remove redundant
test.
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escCALLOTHERSUBR>: Add casts.
* src/psaux/psobjs.c (ps_decoder_init): Add cast.
|
|
6e7da50b
|
2017-09-25T08:29:38
|
|
Documentation fixes.
|
|
d52dd7f3
|
2017-09-25T08:22:26
|
|
Fix Type 1 hinting.
Type 1 hinting breaks sometimes when mid-charstring hints should
have been in the initial hintmap. This fix adds a preprocessing
pass that reads all hints and builds the correct initial hintmap
first, before proceeding to build the glyph outline.
* src/psaux/psintrp.c (cf2_interpT2CharString): New
`initial_map_ready' boolean flag.
Ignore outline commands and hint changes on first pass.
<cf2_cmdENDCHAR>: Add section to build hintmap and rewind.
|
|
999a75b6
|
2017-09-25T08:16:59
|
|
Minor fixes.
* src/psaux/psintrp.c (cf2_interpT2CharString): Fix check for pop
results.
s/font->decoder/decoder/ where necessary.
<cf2_cmdHSTEM, cf2_cmdVSTEM, cf2_escHSTEM3, cf2_escVSTEM3>: Use
offset parameter in `cf2_doStems' instead of doing correction for
left-sidebearing.
|
|
d813b5da
|
2017-09-25T08:04:09
|
|
Extend Adobe interpreter (seac).
This concludes the changes needed to add Type 1 support.
* src/psaux/psintrp.c: Update includes.
(cf2_interpT2CharString) <cf2_escSEAC>: Implement this similarly to
implied seac for CFF.
* src/psaux/t1decode.c (t1_lookup_glyph_by_stdcharcode_ps): New
function to look up the glyph index.
* src/psaux/psft.c (cf2_getT1SeacComponent,
cf2_freeT1SeacComponent): New functions to get the charstrings for
seac components.
* src/psaux/t1decode.h, src/psaux/psft.h: Update declarations.
|
|
d55a701d
|
2017-09-25T07:59:41
|
|
Extend Adobe interpreter (flex in callothersubr).
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escCALLOTHERSUBR>: Fix Flex feature handling (OtherSubrs 0, 1,
2).
<cf2_cmdRMOVETO>: Do not actually move the `glyphPath' while doing
flex. This is to avoid closing the current contour.
|
|
96682559
|
2017-09-25T07:54:02
|
|
Extend Adobe interpreter (callothersubr).
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escCALLOTHERSUBR>: Copy code from
`t1_decoder_parse_charstrings' (in `t1decode.c').
OtherSubr 3 (change hints) should reset the hintmask, so that the
new hints are applied.
Fix function calls and stack access.
|
|
77c1b331
|
2017-09-25T07:50:03
|
|
Extend Adobe interpreter (pop).
* src/psaux/psintrp.c (cf2_interpT2CharString): Change how unhandled
OtherSubr results are stored. Implement the PostScript stack using
an array.
<cf2_escPOP>: Ensure that the stack is not cleared after getting
`OtherSubr' results.
Fix stack access.
|
|
1e4d3dc8
|
2017-09-25T07:47:10
|
|
Extend Adobe interpreter (callsubr).
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdCALLSUBR>:
Type 1 mode.
* src/psaux/psft.c (cf2_initLocalRegionBuffer): Add Type 1 mode.
|
|
4b58c518
|
2017-09-25T07:44:56
|
|
Extend Adobe interpreter (div, four-byte numbers).
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_escDIV>: Add
Type 1 mode. Type 1 requires large integers to be followed by
`div'; cf. `Adobe Type 1 Font Format', section 6.2.
<op == 255>: Push Type 1 four-byte numbers as `Int' always. This is
to ensure `div' and `callsubr' get values they can use.
|
|
81b86c45
|
2017-09-25T07:14:18
|
|
Extend Adobe interpreter (hstem, vstem, hstem3, vstem3).
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdHSTEM,
cf2_cmdVSTEM>: Add correction for left sidebearing in Type 1 mode.
Allow adding hints mid-charstring.
<cf2_escVSTEM3, cf2_escHSTEM3>: Translate into equivalent commands
for three normal stem hints. This requires some recalculation of
stem positions.
Correction for left sidebearing.
|
|
e180afa9
|
2017-09-25T07:11:03
|
|
Extend Adobe interpreter (hsbw, sbw).
* src/psaux/psintrp.c (cf2_doStems): `hsbw' or `sbw' must be the
first operation in a Type 1 charstring.
(cf2_interpT2CharString): Remove unused variables.
<cf2_cmdHMOVETO, cf2_cmdVMOVETO, cf2_cmdRMOVETO>: `hsbw' or `sbw'
must be the first operation in a Type 1 charstring.
<cf2_cmdHSBW, cf2_escSBW>: Fix data access and add correction for
left sidebearing.
|
|
2f4abaec
|
2017-09-25T07:04:43
|
|
Extend Adobe interpreter (setcurrentpoint).
* src/psaux/psintrp.c (cf2_interpT2CharString)
<cf2_escSETCURRENTPT>: Fix stack access.
|
|
4ed1b98d
|
2017-09-25T07:02:53
|
|
Extend Adobe interpreter (closepath).
* src/psaux/psintrp.c (cf2_interpT2CharString) <c2f_cmdCLOSEPATH>:
Use the right builder function. We can use the `haveWidth' boolean
already present, instead of implementing `parse_state'.
|
|
37ed70f6
|
2017-09-25T06:59:26
|
|
Add Type 1 operations to Adobe CFF interpreter.
The following Type 1 specific ops have been added (copied from
`t1decode'):
closepath
vstem3
hstem3
seac
sbw
callothersubr
pop
setcurrentpoint
hsbw
The following require a Type 1 mode, because of differences in
specification:
hstem
vstem
vmoveto
callsubr
div
rmoveto
hmoveto
Numbers
The subsequent commits will implement these changes and adapt
accesses of data and objects to the new interpreter.
NOTE: Will not compile in the meantime!
* src/psaux/psintrp.c: Add opcodes to enum.
(cf2_interpT2CharString): Copy relevant code over from
`t1_decoder_parse_charstrings' (in `t1decode.c').
|
|
0589e3c0
|
2017-09-25T06:10:20
|
|
Use the new objects.
* include/freetype/internal/psaux.h, src/psaux/psauxmod.c: Fix
switching between new and old engines.
* src/cff/cffgload.c, src/cff/cffparse.c: Update calls.
* src/psaux/psblues.c, src/psaux/psfont.c, src/psaux/psfont.h,
src/psaux/psft.c, src/psaux/psft.h, src/psaux/psintrp.c: Update all
to use new objects.
|
|
766f529a
|
2017-09-24T22:40:07
|
|
Rename files.
Replace the `cf2' file name prefix with `ps' as the Adobe engine
will be used for both PostScript Types 1 and 2 (CFF) instead of just
CFF.
s/cf2/ps/ for all following.
* src/psaux/cf2*: Rename files.
* src/psaux/*: Update includes.
* src/psaux/Jamfile (_sources), src/psaux/rules.mk (PSAUX_DRC_SRC,
PSAUX_DRV_H): Update file references.
|