|
b8882a3e
|
2022-10-18T15:58:02
|
|
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Simplify calculations.
|
|
04272824
|
2022-10-17T18:18:49
|
|
[sfnt] Guard individual `COLR` v1 paint field reads.
* src/sfnt/ttcolr.c (ENSURE_READ_BYTES): New macro.
(read_paint): Use it – after the start pointer `p` has been checked for
whether it allows reading the format byte, each successive paint table field
read need to be bounds-checked before reading further values.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52404
|
|
141d979a
|
2022-10-10T12:25:51
|
|
Minor comment changes.
|
|
|
ff66e912
|
2022-09-29T17:46:23
|
|
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics): Use lighter FT_DivFix.
|
|
|
df260139
|
2022-09-27T17:50:55
|
|
[sfnt] Guard access in 'COLR' table when requesting child table pointer.
* src/sfnt/ttcolr.c (tt_face_get_colorline_stops, read_paint): Tighten
pointer bounds checks.
(get_child_table_pointer): Check whether incoming pointer `p` lies within
the 'COLR' table.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51816
|
|
bd417007
|
2022-09-26T14:46:42
|
|
[sfnt] Add SVG document bounds checking.
Add a check that the document content is actually contained within the
`SVG ` table. Without this check a malformed font may claim arbitrary
memory as its document content.
* src/sfnt/ttsvg.c (tt_face_load_svg): Take `numEntries` into account when
testing 'documentRecord' extents.
(find_doc): Rename `stream` to `document_records` for clarity.
(tt_face_load_svg_doc): Split `doc` from `doc_list` pointer for clarity.
Test that the document content is contained within the table.
Ensure minimum length of document before testing for gzip format.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51812
|
|
|
33ceac2a
|
2022-09-15T09:47:07
|
|
Reject 'COLR' table if version is 1 but header too small.
* src/sfnt/ttcolr.c (tt_face_load_colr): If the version is determined to
be 1, then the table size has to be at least the size of the v1 header.
Also, for peeking the number of base glyphs and entries in the layer list,
ensure that the table is sufficiently long.
Fixes #1179. Original patch by Sergey Temnikov.
|
|
|
91a7fae7
|
2022-09-05T15:49:27
|
|
[sfnt] Handle variable `COLR` v1 fonts without delta set index map
Fixes #1178.
* src/sfnt/ttcolr.c (get_deltas_for_var_index_base): Set outer index to
0 and inner index to the delta index when retrieving deltas if the
`COLR` table has no delta set index map.
|
|
|
6d62076a
|
2022-08-30T15:00:37
|
|
[sfnt] Pointer sanity checks before reading layer info in 'COLR' v0
* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Check that the pointer to
read from is within the 'COLR' table.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50633
|
|
|
a1017e26
|
2022-08-19T19:07:42
|
|
[sfnt] Don't require 'gvar' table to support variation fonts.
Fixes #1172.
* src/sfnt/sfobjs.c (sfnt_load_face): Tag font as Multiple Masters font if
`fvar` is present; do not require other tables to be present.
* src/truetype/ttgxvar.c (tt_set_mm_blend): Allow for a missing 'gvar' table
when setting variation coordinates. However, if a 'gvar' table is actually
present, do perform a sanity check and fail on malformedness.
(TT_Get_MM_Var): Don't assume 'fvar' needs 'gvar' or 'CFF2 tables in all
cases, which is an overly tight check.
|
|
|
4797b2ff
|
2022-08-26T12:08:34
|
|
[sfnt] Avoid undefined shifts in `COLR` v1 color line retrieval
* src/sfnt/ttcolr.c (tt_face_get_colorline_stops): Disambiguate shift
behavior by using multiplication using macros from ftcalc.h.
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50573
|
|
|
dcb5fc5b
|
2022-08-02T17:10:25
|
|
* src/sfnt/ttload.c: Trace formatting updates.
|
|
|
919561ca
|
2022-07-30T12:09:21
|
|
[sfnt] Implement VarClipBox.
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Depending on the
format, read `var_index_base`, then retrieve and apply scaled deltas.
|
|
|
649352ab
|
2022-07-30T12:09:09
|
|
[sfnt] Fix typo in clip box computation.
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Use appropriate
scale factor for `yMin` and `yMax`.
|
|
|
a3749a64
|
2022-07-29T21:49:51
|
|
Fix compilation if `TT_CONFIG_OPTION_GX_VAR_SUPPORT` is not set.
* src/sfnt/ttcolr.c: Protect relevant code with
`TT_CONFIG_OPTION_GX_VAR_SUPPORT`.
|
|
|
38dc768a
|
2022-07-29T21:17:06
|
|
Fix clang14 compiler warnings.
* include/freetype/internal/ftstream.h (FT_GET_SHORT_LE, FT_GET_USHORT_LE):
Fix type.
* src/sfnt/ttcolr.c (get_deltas_for_var_index_base): Always return boolean
value.
(tt_face_get_colorline_stops): Fix type of `var_index_base`.
|
|
|
275b116b
|
2022-07-05T15:16:31
|
|
[sfnt] Support variable 'COLR' v1 `PaintVarSkew*`.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal): New enumeration values
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SKEW`,
`FT_COLR_PAINTFORMAT_INTERNAL_SKEW_CENTER`, and
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SKEW_CENTER`.
(read_paint): Handle new enumeration values.
|
|
|
44fd524e
|
2022-07-05T15:09:28
|
|
[sfnt] Support variable 'COLR' v1 `PaintVarRotate*`.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal): New enumeration values
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_ROTATE` and
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_ROTATE_CENTER`.
(read_paint): Handle new enumeration values.
|
|
|
603fef28
|
2022-07-05T14:56:22
|
|
[sfnt] Support 'COLR' v1 variable `PaintVarScale*`.
* src/sfnt/ttcolr.c: (FT_PaintFormatInternal): New enumeration values
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SCALE`,
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SCALE_CENTER`,
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SCALE_UNIFORM`, and
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SCALE_UNIFORM_CENTER`.
(read_paint): Handle new enumeration values.
|
|
|
d134b9e3
|
2022-07-05T14:51:48
|
|
[sfnt] Support for 'COLR' v1 variable translate.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal): New enumeration value
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_TRANSLATE`.
(read_paint): Handle new enumeration value.
|
|
|
8ec531c2
|
2022-07-05T14:47:57
|
|
[sfnt] Support for 'COLR' v1 variable transforms.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal): New enumeration value
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_TRANSFORM`.
(read_paint): Handle new enumeration value.
|
|
|
9c4ad2a9
|
2022-07-05T14:43:10
|
|
[sfnt] Deltas for 'COLR' v1 gradient coordinates.
* src/sfnt/ttcolr.c (read_paint) [TT_CONFIG_OPTION_GX_VAR_SUPPORT]: Read and
apply deltas to radial, linear, and sweep gradient coordinates such as 'p0',
'p1', 'p2', 'center', 'radii', and 'angles'.
|
|
|
3414fef7
|
2022-07-04T16:29:31
|
|
[sfnt] Support variable 'COLR' v1 color lines.
* include/freetype/ftcolor.h (FT_ColorStopIterator): Add field
`read_variable` to indicate whether a variation index base should be read.
* src/sfnt/ttcolr.c: (FT_PaintFormat_Internal): New enumerations
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_LINEAR_GRADIENT`
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_RADIAL_GRADIENT`, and
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SWEEP_GRADIENT`.
(read_color_line): New parameter `read_variable`; update callers.
(read_paint): Handle new enumerations.
|
|
|
7c151abb
|
2022-07-04T12:44:06
|
|
[sfnt] Apply variation deltas to `PaintVarSolid`.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal_): New enumeration
`FT_COLR_PAINTFORMAT_INTERNAL_VAR_SOLID`.
(get_deltas_for_var_index_base) [TT_CONFIG_OPTION_GX_VAR_SUPPORT]: New
function to retrieve an array of delta values, which will be used for most
of 'COLR' v1 variation formats (in follow-up commits).
(read_paint): Add `face` parameter; update caller.
Handle `FT_COLR_PAINTFORMAT_INTERNAL_VAR_SOLID`.
|
|
|
8a9192f6
|
2022-07-07T13:02:10
|
|
[sfnt] Check safety of cast to `TT_Driver` before accessing member.
* src/sfnt/ttcolr.c (VARIABLE_COLRV1_ENABLED): Access
`enable_variable_colrv1` only if driver class matches.
|
|
|
31b14fd4
|
2022-06-29T16:01:13
|
|
[sfnt] Load variation store for 'COLR' v1.
* src/sfnt/ttcolr.c: Include `ttobjs.h` temporarily.
(VARIABLE_COLRV1_ENABLED): New temporary macro to detect whether variable
COLRv1 is enabled.
(Colr): New fields `var_store` and `delta_set_idx_map`.
(tt_face_load_colr, tt_face_free_colr) [VARIABLE_COLRV1_ENABLED]: Load and
free variation store data using the functions from the Multiple Masters
service.
|
|
|
117df36b
|
2022-06-22T09:33:20
|
|
[sfnt] Upgrade stop_offset to FT_Fixed from FT_F2Dot14
|
|
|
2848378b
|
2022-06-21T17:08:04
|
|
s/fixed point/fixed-point/
|
|
|
58395dd2
|
2022-06-13T15:28:00
|
|
[woff] Don't allocate table entries until needed
* src/sfnt/sfwoff.c (woff_open_font): delay allocating space for the
table entries until they are actually written out with the data.
|
|
|
8b6bcc92
|
2022-06-12T09:04:13
|
|
* src/sfnt/sfwoff2.c (woff2_open_font): Partial revert.
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47981.
|
|
|
73631b95
|
2022-06-11T16:10:40
|
|
[woff, woff2] Avoid buffer zeroing.
* src/sfnt/sfwoff.c (woff_open_font): Use Q-macros.
* src/sfnt/sfwoff2.c: Ditto.
(reconstruct_font): Allocate table_entry on stack.
|
|
b98dd169
|
2022-05-25T14:49:37
|
|
* src/sfnt/ttmtx.c (tt_face_get_metrics): Apply variations unconditionally.
This causes a speed-up of approx. 20% for getting advance widths.
|
|
|
62bc04f4
|
2022-04-30T15:37:14
|
|
* src/sfnt/sfobjs.c (sfnt_load_face): Set `FT_FACE_FLAG_COLOR` for SVG fonts.
Fixes #1151.
|
|
|
fc082956
|
2022-04-01T14:44:42
|
|
* src/sfnt/sfwoff.c (reconstruct_glyf): Fix gcc 10 warning.
|
|
|
695d606a
|
2022-04-01T08:50:33
|
|
Whitespace.
|
|
|
87989a14
|
2022-03-31T07:43:41
|
|
Fix clang++ warnings.
* src/base/ftglyph.c (ft_svg_glyph_prepare), src/base/ftobj.c
(ft_glyphslot_init), src/cache/ftccmap.c (ftc_cmap_node_new),
src/cache/ftcimage.c (FTC_INode_New), src/lzw/ftlzw.c (FT_Stream_OpenLZW),
src/psaux/psobjs.c (ps_parser_load_field), src/pshinter/pshglob.c
(psh_globals_new), src/sfnt/ttsvg.c (tt_face_load_svg_doc): Initialize
variables used for allocation.
* src/sdf/ftsdf.c (split_sdf_conic, split_sdf_cubic): Change type of
`max_splits` to FT_UInt.
(sdf_generate_bounding_box): Add cast.
|
|
|
a8e4563c
|
2022-03-19T23:54:31
|
|
Add `FT_FACE_FLAG_SBIX_OVERLAY` and `FT_HAS_SBIX_OVERLAY`.
* include/freetype/freetype.h (FT_FACE_FLAG_SBIX_OVERLAY,
FT_HAS_SBIX_OVERLAY): New macro.
* src/sfnt/ttsbit.c (tt_face_load_sbit): Handle `FT_FACE_FLAG_SBIX_OVERLAY`.
Remove obsolete tracing message.
|
|
|
1949a7ec
|
2022-03-19T18:51:34
|
|
Add `FT_PARAM_TAG_IGNORE_SBIX`.
This is another bit to handle 'sbix' tables as described in the OpenType
specification.
* include/freetype/ftparams.h (FT_PARAM_TAG_IGNORE_SBIX): New macro.
* src/sfnt/sfobjc.c (is_apple_sbix): Rename to...
(has_sbix): ... this.
Check for more sbit tables.
Handle `FT_PARAM_TAG_IGNORE_SBIX` to eventually control `has_sbix`.
Only call sbit table loader if an sbit table is present.
|
|
|
ac4c1ebf
|
2022-02-07T06:55:54
|
|
[truetype] Fix 'sbix' table handling.
* src/sfnt/ttsbit.c (tt_face_load_sbix_image): Correct calculation of
'metrics->horiBearingY'.
Set vertical metrics.
* src/sfnt/sfobjs.c (sfnt_load_face): Adjust setting of `FT_FACE_FLAG_SBIX`.
Handle metrics of fonts with 'sbix' table.
* src/truetype/ttgload.c (TT_Load_Glyph): For 'sbix' embedded bitmaps, apply
bbox offset and bearing values of the corresponding glyph in the 'glyf'
table if it exists and has a contour.
* src/truetype/ttobjs.c (tt_face_init): Handle font with 'sbix' table.
Fixes issue #998.
|
|
|
907715a6
|
2022-02-09T07:31:56
|
|
Add `FT_FACE_FLAG_SBIX` and `FT_HAS_SBIX`.
Fonts with 'sbix' tables need special handling by the application.
* include/freetype/freetype.h (FT_FACE_FLAG_SBIX, FT_HAS_SBIX): New macros.
* src/sfnt/sfobjs.c (sfnt_load_face): Set `FT_FACE_FLAG_SBIX` if 'sbix'
table is present.
|
|
|
fc15ebe0
|
2022-03-21T11:15:41
|
|
* src/sfnt/ttkern.c (tt_face_get_kerning): Exit early if no table.
Fixes #1141.
|
|
|
a960be9e
|
2022-03-18T17:41:01
|
|
[woff2] Support overlap flag for simple glyphs.
In the woff2 spec it has been proposed to allow the OVERLAP_SIMPLE flag
to be retained through the woff2 format [0].
[0] https://www.w3.org/TR/WOFF2/#glyf_table_format
* src/sfnt/sfwoff2.h (GLYF_OVERLAP_SIMPLE): add glyf flag.
* src/sfnt/sfwoff2.c (reconstruct_glyf): parse optionFlags and
overlapSimpleBitmap[]. (store_points): set OVERLAP_SIMPLE on first point's
flag if the overlap bit is set.
|
|
|
53dfdcd8
|
2022-03-17T19:24:16
|
|
[sfnt] Avoid invalid face index.
Fixes #1138.
* src/sfnt/sfobjs.c (sfnt_init_face), src/sfnt/sfwoff2.c (woff2_open_font):
Check `face_index` before decrementing.
|
|
|
1e2eb650
|
2022-03-07T10:13:29
|
|
Documentation, whitespace.
|
|
|
335224be
|
2022-03-03T16:33:40
|
|
[sfnt] Fix bounds check in SVG.
The `SVG_DOCUMENT_LIST_MINIMUM_SIZE` macro is non trivial and not
protected by parentheses. As a result, the expression
`table_size - SVG_DOCUMENT_LIST_MINIMUM_SIZE` expands to
`table_size - 2U + SVG_DOCUMENT_RECORD_SIZE` instead of the expected
`table_size - (2U + SVG_DOCUMENT_RECORD_SIZE)`. This causes an incorrect
bounds check which may lead to reading past the end of the `SVG ` table.
* src/sfnt/ttsvg.c (tt_face_load_svg): wrap macro definitions in
parentheses.
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45179
|
|
|
5b26e92a
|
2022-02-19T05:26:53
|
|
src/sfnt/ttkern.c (tt_face_load_kern): Micro-optimize.
A kerning table can be handled by binary search if it has equal entries.
Fixes #1132.
|
|
|
bee88864
|
2022-01-30T21:55:21
|
|
Clean-up - do not doubt FT_FREE.
* src/base/ftobjs.c (memory_stream_close): Do not reassign zero
after `FT_FREE`.
* src/sfnt/sfwoff.c (sfnt_stream_close): Ditto.
* src/sfnt/sfwoff2.c (stream_close): Ditto.
* src/psaux/psobjs.c (ps_parser_load_field): Ditto.
* src/truetype/ttgxvar.c (ft_var_load_avar, tt_set_mm_blend,
tt_set_mm_blend): Ditto.
|
|
|
b34741c1
|
2022-01-27T22:55:34
|
|
Minor clean-ups.
* src/base/ftrfork.c (raccess_make_file_name): Do not set error.
* src/sfnt/sfdriver.c (get_win_string, get_apple_string): Ditto.
* src/cff/cffobjs.c (cff_strcpy): Do not confuse about error.
* src/psaux/psobjs.c (ps_table_done): Ditto.
* src/truetype/ttgxvar.c (ft_var_readpacked*, ft_var_load_avar): Ditto.
|
|
|
112527dd
|
2022-01-22T11:45:30
|
|
[sfnt] Reject malformed SVG tables.
* src/sfnt/ttsvg.c (SVG_TABLE_HEADER_SIZE, SVG_DOCUMENT_RECORD_SIZE,
SVG_DOCUMENT_LIST_MINIMUM_SIZE, SVG_MINIMUM_SIZE): New macros.
(tt_face_load_svg): Check offsets.
Check table and record sizes.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43918
|
|
0bf49bd2
|
2021-12-25T20:14:11
|
|
Add 'svg' module for OT-SVG rendering.
* CMakeLists.txt (BASE_SRCS): Add svg module file.
* meson.build (ft2_public_headers): Add `otsvg.h`.
* modules.cfg (RASTER_MODULES): Add `svg` module.
* builds/meson/parse_modules_cfg.py: Add svg module.
* include/freetype/config/ftmodule.h: Add `ft_svg_renderer_class`.
* include/freetype/fterrdef.h: Add `Invalid_SVG_Document` and
`Missing_SVG_Hooks` error codes.
* include/freetype/internal/fttrace.h: Add tracing for `otsvg`.
* include/freetype/internal/svginterface.h: New file. It adds an interface
to enable the presetting hook from the `base` module.
* include/freetype/otsvg.h (SVG_Lib_Init_Func, SVG_Lib_Free_Func,
SVG_Lib_Render_Func, SVG_Lib_Preset_Slot_Func): New hooks for SVG rendering.
(SVG_RendererHooks): New structure to access them.
* src/base/ftobjs.c: Include `svginterface.h`.
(ft_glyphslot_preset_bitmap): Add code for presetting the slot for SVG
glyphs.
(ft_add_renderer): Updated.
* src/svg/*: New files.
|
|
|
f93a897a
|
2021-12-25T19:20:44
|
|
Add code to load OT-SVG glyph documents.
* include/freetype/config/ftheader.h (FT_OTSVG_H): New macro.
* include/freetype/freetype.h (FT_FACE_FLAG_SVG, FT_HAS_SVG): New macros.
(FT_LOAD_SVG_ONLY): New internal macro.
* include/freetype/ftimage.h (FT_Glyph_Format): New enumeration value
`FT_GLYPH_FORMAT_SVG`.
* include/freetype/internal/ftobjs.h (FT_GLYPH_OWN_GZIP_SVG): New macro.
* include/freetype/internal/fttrace.h: Add `ttsvg` for `ttsvg.c`.
* include/freetype/internal/sfnt.h(load_svg, free_svg, load_svg_doc): New
functions.
* include/freetype/internal/tttypes.h (TT_FaceRec): Add `svg` for
the SVG table.
* include/freetype/otsvg.h (FT_SVG_DocumentRec): New structure to hold the
SVG document and other necessary information of an OT-SVG glyph in a glyph
slot.
* include/freetype/tttags.h (TTAG_SVG): New macro.
* src/base/ftobjs.c: Include `otsvg.h`.
(ft_glyphslot_init): Allocate `FT_SVG_DocumentRec` in `slot->other`
if the SVG table exists.
(ft_glyphslot_clear): Free it upon clean-up if it is a GZIP compressed
glyph.
(ft_glyphslot_done): Free the document data if it is a GZIP compressed
glyph.
(FT_Load_Glyph): Don't auto-hint SVG documents.
* src/cache/ftcbasic.c (ftc_basic_family_load_glyph): Add support for
FT_GLYPH_FORMAT_SVG.
* src/sfnt/rules.mk (SFNT_DRV_SRC): Add `ttsvg.c`.
* src/sfnt/sfdriver.c: Include `ttsvg.h`.
(sfnt_interface): Add `tt_face_load_svg`, `tt_face_free_svg` and
`tt_face_load_svg_doc`.
* src/sfnt/sfnt.c: Include `ttsvg.c`.
* src/sfnt/sfobjs.c (sfnt_load_face, sfnt_done_face): Add code to load and
free data of the the SVG table.
* src/sfnt/ttsvg.c: New file, implementing `tt_face_load_svg`,
`tt_face_free_svg` and `tt_face_load_svg_doc`.
* src/sfnt/ttsvg.h: Declarations of the SVG functions in
`ttsvg.c`.
|
|
|
3876846e
|
2022-01-11T13:40:20
|
|
[sfnt] Fix limit checks for `COLR` v1 ClipBoxes
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Fix off-by-one in
limit checks.
|
|
|
d0cfb4e1
|
2022-01-11T10:54:10
|
|
Update all copyright notices.
|
|
|
947fddc8
|
2022-01-09T07:26:26
|
|
* src/sfnt/ttcolr.c (read_paint): Fix undefined left-shift operation.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43151
|
|
|
4a89112b
|
2022-01-08T16:56:57
|
|
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Add limit checks.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40716
|
|
|
ca011128
|
2022-01-08T22:28:44
|
|
[sfnt] Fix off-by-one error.
The 0-base index is equal to the number of previosly parsed entries.
It is an error to adjust it by one to get the number truncated by
a stream error. This is probably inconsequential because valid
entries are correctly accounted for.
* src/sfnt/ttload.c (check_table_dir): Do not adjust the truncated
number of tables.
|
|
|
7a493e3a
|
2022-01-08T10:28:19
|
|
[sfnt, type42] Correct previous commit.
Really fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42773.
* src/sfnt/ttload.c (check_table_dir): Revert change.
* src/type42/t42.parse.c (t42_parse_sfnts): Don't use `FT_QREALLOC` but
`FT_REALLOC` for setting up `ttf_data` to avoid uninitialized memory access
while handling malformed TrueType fonts later on.
|
|
|
bf9b1ef9
|
2022-01-07T10:25:52
|
|
* src/sfnt/ttload.c (check_table_dir): Initialize `table`.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42773
|
|
|
b5c2172f
|
2022-01-07T06:53:44
|
|
[sfnt] Avoid 'runtime error: applying zero offset to null pointer'.
* src/sfnt/ttsbit.c (tt_sbit_decoder_load_byte_aligned): Exit early if
`line` is NULL.
|
|
|
9597fd7b
|
2021-11-11T17:33:37
|
|
[sfnt] Avoid undefined shifts in `COLR` v1 paint parsing
* src/sfnt/ttcolr.c (read_paint, tt_face_get_paint): Tighten shift
behavior by using multiplication, mostly using macros from ftcalc.h.
Fixes: https://bugs.chromium.org/p/chromium/issues/detail?id=1269168
|
|
|
d899b200
|
2021-11-08T12:27:04
|
|
* src/sfnt/sfobjs.c (sfnt_open_font): Fix typo.
|
|
|
7ef26604
|
2021-11-04T09:10:57
|
|
[sfnt] Reduce footprint if WOFF and WOFF2 support is not needed.
Based on a patch from metarutaiga (MR !106). The gist of this commit is
that it doesn't make sense to support WOFF without compression (which would
be only possible in WOFF 1.0 anyway).
* src/sfnt/sfobjs.c (sfnt_open_font): Guard WOFF code with
`FT_CONFIG_OPTION_USE_ZLIB` block.
Guard WOFF2 code with `FT_CONFIG_OPTION_USE_BROTLI` block.
* src/sfnt/sfwoff.c, src/sfnt/sfwoff.h: Guard files with
`FT_CONFIG_OPTION_USE_ZLIB` blocks, not parts of the code.
* src/sfnt/sfwoff2.c, src/sfnt/sfwoff2.h, src/sfnt/woff2tags.c,
src/sfnt/woff2tags.h: Guard files with `FT_CONFIG_OPTION_USE_BROTLI` blocks,
not parts of the code.
Fixes #1111.
|
|
|
9ebdc9cb
|
2021-11-07T23:21:40
|
|
* src/sfnt/ttload.c (tt_face_load_gasp): Fix a type mismatch warning.
|
|
|
d3d3ff76
|
2021-11-01T17:32:27
|
|
[sfnt] Clarify `COLR` v1 FT_Paint* format representations
* include/freetype/ftcolor.h (FT_PaintLinearGradient,
FT_PaintRadialGradient, FT_PaintSweepGradient, FT_PaintTransform,
FT_PaintTranslate, FT_PaintScale, FT_PaintRotate, FT_PaintSkew): Clarify
16.16 fixed point representation of struct fields.
* src/sfnt/ttcolr.c (read_paint): Shift coordinates for
FT_PaintLinearGradient, FT_PaintRadialGradient, FT_PaintSweepGradient
accordingly.
Fixes: https://gitlab.freedesktop.org/freetype/freetype/-/issues/1110
|
|
|
793c0126
|
2021-10-27T22:36:11
|
|
[woff] Optimize table tagging.
* include/freetype/internal/wofftypes.h (WOFF_TableRec): Use
32-bit tag.
* src/sfnt/sfwoff.c (woff_open_font): Use 32-bit tag.
|
|
|
a577bbcb
|
2021-10-27T22:24:27
|
|
[woff2] Optimize table tagging.
Fixes #1107.
* include/freetype/internal/wofftypes.h (WOFF2_TableRec): Use
32-bit tag.
* src/sfnt/sfwoff2.c (compare_tags, find_table, woff2_open_font):
Use 32-bit tag.
* src/sfnt/woff2tags.[ch] (woff2_known_tags): Use static storage and
return 32-bit tag.
|
|
|
80b13f57
|
2021-10-26T10:57:17
|
|
Formatting.
|
|
|
fde91ab8
|
2021-10-20T11:45:15
|
|
[sfnt] Delay setting gasp ranges and count until computed.
Previously, the gasp.numRanges was set and gasp.gaspRanges was
allocated and assigned before a possible early exit if the frame could
not be entered. It is also possible that the gaspRanges allocation
could fail but the numRanges still be set to non-zero. In such cases
an error would be returned, but the face would have a gasp in an
inconsistent state which may still be accessed.
Reported as
https://bugs.chromium.org/p/chromium/issues/detail?id=1261450
* src/sfnt/ttload.c (tt_face_load_gasp): Delay setting gasp.numRanges
and gasp.gaspRanges until after the ranges are initialized.
|
|
|
6d12e3a0
|
2021-10-20T11:38:16
|
|
[sfnt] Delay setting names and langTags until computed.
Previously, the table->names and table->langTags fields were created
pointing to uninitialized memory and an early exit could happen if the
frame could not be entered. The caller would then be unable to properly
dispose of the memory as the string fields had not been initialized.
Reported as
https://bugs.chromium.org/p/chromium/issues/detail?id=1261343
* src/sfnt/ttload.c (tt_face_load_name): delay setting table->langTags
and table->names until after the memory they will point to is fully
initialized.
|
|
|
986d503f
|
2021-10-17T09:14:27
|
|
* src/sfnt/ttload.c (tt_face_load_name): NULL-initialize langTag.
Another attempt to fix fallout reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40024
|
|
|
afd1cb28
|
2021-10-16T20:25:11
|
|
* src/sfnt/ttload.c (tt_face_load_name): Accounting fix.
Fallout reported as
https://crbug.com/40024
|
|
|
c71eb22d
|
2021-10-15T22:18:38
|
|
Fix typos in memory macros.
FT_QNEW_ARRAY and FT_QRENEW_ARRAY were using the non-Q
FT_MEM_NEW_ARRAY and FT_MEM_RENEW_ARRAY. Change these to use the Q
versions. Also fix the one issue discovered in tt_face_load_name
where table->names is created with FT_QNEW_ARRAY but the extra
string member is not initialized to NULL.
* include/freetype/internal/ftmemory.h (FT_Q(RE)NEW_ARRAY):
Use FT_MEM_Q(RE)NEW_ARRAY as needed.
* src/sfnt/ttload.c (tt_face_load_name): Initialize `entry->string`.
|
|
|
49270c17
|
2021-09-14T21:32:43
|
|
Replace boolean allocation macros with MEM ones.
* src/base/ftbitmap.c (FT_Bitmap_Copy): Use MEM-macro.
* src/base/ftobjs.c (ft_glyphslot_alloc_bitmap): Ditto.
* src/bzip2/ftbzip2.c (ft_bzip2_alloc): Ditto.
* src/cache/ftccache.c (ftc_cache_init): Ditto
* src/gzip/ftgzip.c (ft_gzip_alloc): Ditto.
* src/psnames/psmodule.c (ps_unicodes_init): Ditto.
* src/sfnt/sfobjs.c (sfnt_load_face): Ditto.
* src/sfnt/ttload.c (tt_face_load_name): Ditto.
|
|
|
058f3f2d
|
2021-09-13T16:24:25
|
|
[bdf, psnames, sfnt] Avoid some memory zeroing.
* src/bdf/bdfdrivr.c (BDF_Face_Init): Use Q-macro.
* src/sfnt/sfobjs.c (sfnt_load_face): Ditto.
* src/psnames/psmodule.c (src/psnames/psmodule.c): Remove zero.
|
|
|
633fe087
|
2021-08-19T16:56:22
|
|
[sfnt] Fix format expectation for `COLR` v1 ClipList
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Change ClipList
format expectation to 1 instead of 0 to make it compliant with the
latest spec.
|
|
|
fed55210
|
2021-08-09T19:27:34
|
|
* src/sfnt/ttcolr.c (tt_face_get_color_glyph_clipbox): Minor fix.
|
|
|
47cf8ebf
|
2021-07-28T17:36:57
|
|
[sfnt] Add API for retrieving a 'COLR' v1 'ClipBox' table.
The optional 'COLR' v1 glyph-specific clip box helps upstream graphics
libraries allocate a sufficiently large bitmap for a glyph without having to
traverse the glyph graph for that. See
https://github.com/googlefonts/colr-gradients-spec/issues/251
for background on the introduction of this specification change.
* include/freetype/ftcolor.h (FT_ClipBox): New structure.
(FT_Get_Color_Glyph_ClipBox): New function declaration.
* include/freetype/internal/sfnt.h (TT_Get_Color_Glyph_ClipBox_Func):
New function type.
(SFNT_Interface, FT_DEFINE_SFNT_INTERFACE): Use it.
* src/base/ftobjs.c (FT_Get_Color_Glyph_ClipBox): New function to link API
with SFNT implementation.
* src/sfnt/sfdriver.c (sfnt_interface): Updated.
* src/sfnt/ttcolr.c (Colr): New field `clip_list`.
(tt_face_load_colr): Parse global clip list offset.
(tt_face_get_color_glyph_clipbox): New function to find the clip box for a
glyph id from the clip list array.
* src/sfnt/ttcolr.h: Updated.
|
|
|
d2367aba
|
2021-07-29T08:16:25
|
|
src/sfnt/ttcolr.c: Minor formatting.
|
|
|
30a82e1e
|
2021-07-26T18:28:56
|
|
[sfnt] 'COLR' v1 PaintSweepGradient spec update
* src/sfnt/ttcolr.c (read_paint): PaintSweepGradient follows other
spec changes and now has the angles specified as F2DOT14, reflect
that in the implementation.
* include/freetype/ftcolor.h (FT_PaintSweepGradient): Update
documentation.
|
|
|
5c0ac7a4
|
2021-07-26T17:32:09
|
|
[sfnt] Retrieve affine matrix from offset in 'COLR' v1 parsing.
* src/sfnt/ttcolr.c (read_paint): Implement spec change where
affine transform matrix is now referenced by offset instead of
being placed inline in the PaintTransform table.
|
|
|
66189807
|
2021-07-26T17:32:22
|
|
[sfnt] 'COLR' v1 PaintSkew related spec updates
* src/sfnt/ttcolr.c (read_paint): Implement spec changes around
PaintSkew, PaintSkewAroundCenter. Update parsing to read shorter
values as changed in the spec.
* include/freetype/ftcolor.h (FT_PaintSkew): Update documentation.
|
|
|
48df0fa6
|
2021-07-23T19:02:51
|
|
[sfnt] PaintRotate/PaintRotateAroundCenter spec updates
* src/sfnt/ttcolr.c (read_paint): Implement spec change where
PaintRotate and PaintRotateAroundCenter were split for a more
compact format definition. Update parsing to read shorter values
as changed in the spec.
* include/freetype/ftcolor.h (FT_PaintRotate): Update documentation.
|
|
|
d7bdcb1b
|
2021-07-23T19:37:47
|
|
[sfnt] 'COLR' v1 PaintTranslate and PaintScale precision
* src/sfnt/ttcolr.c (read_paint): Implement spec changes in
PaintTranslate and PaintScale and friends. Update parsing to read
new shorter values.
|
|
|
801cd842
|
2021-07-18T07:53:57
|
|
* Version 2.11.0 released.
==========================
Tag sources with `VER-2-11-0'.
* docs/VERSION.TXT: Add entry for version 2.11.0.
* docs/CHANGES: Updated.
* README, src/base/ftver.rc, builds/windows/vc2010/index.html,
builds/windows/visualc/index.html,
builds/windows/visualce/index.html,
builds/wince/vc2005-ce/index.html,
builds/wince/vc2008-ce/index.html, docs/freetype-config.1:
s/2.10.4/2.11.0/, s/2104/2110/.
* include/freetype/freetype.h (FREETYPE_MINOR): Set to 11.
(FREETYPE_PATCH): Set to 0.
* builds/unix/configure.raw (version_info): Set to 24:0:18.
* CMakeLists.txt (VERSION_MINOR): Set to 11.
(VERSION_PATCH): Set to 0.
* builds/toplevel.mk (dist): Ignore more git-related files.
|
|
|
286da6c5
|
2021-06-22T15:01:19
|
|
[sfnt] Support PaintScale in 'COLR' v1 parsing.
* include/freetype/ftcolor.h (FT_PaintFormat): Renumber values, add
`FT_COLR_PAINTFORMAT_SCALE`.
(FT_PaintScale): New structure to represent 'PaintScale*' tables.
(FT_COLR_Paint): Updated.
* src/sfnt/ttcolr.c (FT_PaintFormat_Internal): New enumeration.
(read_paint): Parse 'PaintScale' and friends.
|
|
|
0348c627
|
2021-06-29T20:51:32
|
|
[sfnt] Handle fonts without layer list in 'COLR' v1.
'COLR' v1 fonts do not necessarily need to have a layer list; for
this reason, 'fontTools' recently started generating fonts in a way
that drops the layer list if there are no layers in it. This
results in the layer list offset becoming zero, which FreeType
treated as an invalid table. Fix that and handle the case for layer
list offset being 0. This slightly changes how we need to calculate
the starting offset for paints.
* src/sfnt/ttcolr.c (tt_face_load_colr): Handle case of layer list
offset being zero without outright rejecting table.
|
|
|
7d4e55c3
|
2021-06-28T16:29:49
|
|
[sfnt] Improve paint limit checks
Paint tables can appear before the `base_glyphs_v1` offset if the
font is produced with the layer list before the base glyph list. In
this case paint tables can occur after the layer list but before the
base glyph list. Checks in the 'COLR' v1 code were rejecting fonts
with this layout. Improve these checks by calculating a minimum
offset after which paint tables can occur and use that in safety
checks.
* src/sfnt/ttcolr.c (Colr, tt_face_load_colr): Declare
`paint_start_v1` and calculate that as the minimum of the end of
layer list and base glyph list.
(get_child_table_pointer, read_paint, tt_face_get_paint_layers):
Use that in safety checks.
|
|
|
4cb21b9a
|
2021-06-22T20:50:48
|
|
[sfnt] s/PaintTransformed/PaintTransform/, s/transformed/transform/.
* include/freetype/ftcolor.h (FT_PaintTransformed, FT_PaintFormat,
FT_COLR_Paint): Do it to make it harmonize with other names such as
'PaintTranslate'.
* src/sfnt/ttcolr.c (read_paint, tt_face_get_paint): Ditto.
|
|
|
08f66322
|
2021-06-08T18:23:16
|
|
More various documentation improvements and fixes.
|
|
|
b24cfc8d
|
2021-06-08T15:26:41
|
|
[sfnt] Sanitize cmap4 table better.
Fixes #1062.
* src/sfnt/ttcmap.c (tt_cmap4_validate): Handle a too-small value of
`length` gracefully.
|
|
|
ee6d03d3
|
2021-06-08T14:29:11
|
|
[sfnt] Pointer validity check when reading COLR 'v1' layers
* src/sfnt/ttcolr.c (tt_face_get_paint_layers): In addition to the
existing sanity checks, ensure that the pointer to the layer to be
read is within the 'COLR' v1 table.
|
|
|
2a6665a4
|
2021-06-01T15:25:31
|
|
[sfnt] Fix fallout from 2021-05-29 change.
* src/sfnt/ttcolr.c (find_base_glyph_record,
find_base_glyph_v1_record): Adjust binary search.
Needs to be updated with change to unsigned.
|
|
|
a50c39aa
|
2021-05-29T09:50:29
|
|
Fix compilation errors and (some) warnings for clang++.
* src/autofit/afmodule.c (AF_GlyphHintsRec): Make it static.
* src/cache/ftcache.c (FTC_Cache_NewNode), src/cache/ftcsbits.c
(ftc_snode_compare): Remove semicolon.
* src/cff/cffparse.c (cff_parser_run): Add `break` statement.
* src/cid/cidload.c (cid_hex_to_binary): Add cast.
* src/sdf/ftbsdf.c (CHECK_NEIGHBOR): Use `do {} while(0)` loop.
(bsdf_init_distance_map, finalize_sdf, bsdf_raster_render): Add
casts.
* src/sdf/ftsdf.c (sdf_generate_bounding_box,
sdf_generate_with_overlaps): Ditto.
* src/sdf/ftsdfcommon.h (square_root): Ditto.
* src/sdf/ftsdfrend.c (sdf_property_get, ft_sdf_render,
ft_bsdf_render): Ditto.
* src/sfnt/ttcolr.c (find_base_glyph_record,
find_base_glyph_v1_record): Fix variable signedness.
(read_color_line): Add cast.
(read_paint): Add casts.
Fix signedness issue.
(tt_face_get_colorline_stops) Fix signedness issues.
* src/sfnt/ttpost.c (load_format_20): Add casts.
* src/truetype/ttsubpix.c (TWEAK_RULES, TWEAK_RULES_EXCEPTIONS):
Remove final semicolons.
|
|
|
1bc801b0
|
2021-05-16T23:12:01
|
|
[sfnt] Additional guards on the POST table.
Fixes timeout (#1055) analyzed by Ben Wagner, reported as
https://crbug.com/1194092
* src/sfnt/ttload.c (tt_face_load_post): Check POST format.
* src/sfnt/sfobjs.c (sfnt_load_face): Synthesize the missing unicode
charmap only if the glyph names exist.
* src/psnames/psmodule.c (ps_unicode_value): Short cut ".notdef" and
".null".
|
|
|
44c59414
|
2021-05-06T22:54:03
|
|
* src/sfnt/sfobjs.c (sfnt_load_face): Tweak allocation macro.
|
|
|
66630d88
|
2021-05-03T22:40:16
|
|
[sfnt] Streamline POST format 2.0 handing.
To reduce memory allocations, we read an entire Pascal-string buffer
and convert it to a C-string buffer. We also reject tables with
Postscript glyph names exceeding 63 bytes.
* src/sfnt/ttpost.c (load_format20): Implement it.
(load_post_names): Check the minimal POST table size.
(load_format25, tt_face_free_ps_names): Updated accordingly.
|
|
|
dc42f826
|
2021-05-01T12:46:44
|
|
[sfnt] Avoid some memory zeroing.
* src/sfnt/sfobjs.c (sfnt_open_font, sfnt_init_face,
tt_name_ascii_from_{utf16,other}): Tweak allocaton macros.
* src/sfnt/ttload.c (tt_face_load_name): Ditto.
|
|
|
b8968d66
|
2021-05-01T12:24:44
|
|
* src/sfnt/ttpost.c (load_format_{20,25}): Tweak allocaton macros.
|
|
|
2583b608
|
2021-05-01T09:22:26
|
|
* src/sfnt/pngshim.c (Load_SBit_Png): Tweak allocaton macro.
|
|
|
c177cc35
|
2021-05-01T09:09:52
|
|
[woff2] Avoid some memory zeroing.
* src/sfnt/sfwoff2.c (store_loca, woff2_open_font): Tweak macros.
|