* src/psaux/psintrp.c (cf2_interpT2CharString): The call to
`cf2_arrstack_setCount' may fail because the allocator ran out of
memory. When this happens the stack is still written to before the
error condition is checked. This means that FreeType writes outside
of allocated memory. This commit moves the error check prior to the
stack assignment, hence the function now properly returns with an
error condition.
All of the Type 1 path building is done with code common to the
revised CFF engine, with the exception of closepath, which was still
calling ps_builder_close_contour(), thus previously cached segments
were not always written to the path, and glyph corruption, or even
invalid outlines were possible.
* src/psauc/psinterp.c (cf2_interpT2CharString) <cf2_cmdCLOSEPATH>:
Switch to calling `cf2_glyphpath_closeOpenPath'.
Before this commit we had code like
(FT_Bool)( globals->glyph_styles[gindex] & 0x8000)
Since `FT_Bool' is defined to be an `unsigned char', the code
evaluated to something like
(unsigned char)( 0x8532 & 0x8000)
which in turn expanded to
(unsigned char)( 0x8000)
and finally yielded 0x00 – i.e., false – not as expected.
Problem reported and analyzed by Tony Smith <tony.smith@macro4.com>.
* include/freetype/fttypes.h (FT_BOOL): Add a comparison against
zero so that we always have a Boolean expression.
*/*: Replace castings to `FT_Bool' with calls to `FT_BOOL' where
possible.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10080
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings) <cff_op_roll>
[CFF_CONFIG_OPTION_OLD_ENGINE]: Use modulo for loop count, as
documented in the specification.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9864
* src/psaux/cffdecode.c (cff_decoder_parse_charstrings)
<cff_op_random> [CFF_CONFIG_OPTION_OLD_ENGINE]: Use top dict's
`random' field directly if parsing dictionaries.
This monster commit was created by applying Nikhil's scripts
`docconverter.py' and `markify.py' to all C header and source files,
followed up by minor manual clean-up.
No change in functionality, of course.
I used commit f7419907bc6044b9b7057f9789866426c804ba82 from
https://github.com/nikramakrishnan/freetype-docs.git.
*/* [FT_CONFIG_OPTION_PIC]: Remove all code guarded by this
preprocessor symbol.
*/*: Replace `XXX_GET' macros (which could be either a function in
PIC mode or an array in non-PIC mode) with `xxx' arrays.
* include/freetype/internal/ftpic.h, src/autofit/afpic.c,
src/autofit/afpic.h, src/base/basepic.c, src/base/basepic.h,
src/base/ftpic.c, src/cff/cffpic.c, src/cff/cffpic.h,
src/pshinter/pshpic.c, src/pshinter/pshpic.h, src/psnames/pspic.c,
src/psnames/pspic.h, src/raster/rastpic.c, src/raster/rastpic.h,
src/sfnt/sfntpic.c, src/sfnt/sfntpic.h, src/smooth/ftspic.c,
src/smooth/ftspic.h, src/truetype/ttpic.c, src/truetype/ttpic.h:
Removed.
According to the CFF specification, charstrings can have up to 96 stem
hints. Due to hint replacement routines in Type 1 charstrings, some
glyphs are rejected by the Adobe engine, which implements the above
limit. This fix turns off hinting for such glyphs.
* src/psaux/pshints.c (cf2_hintmap_build): Reset the error from calling
`cf2_hintmask_setAll' on a problematic Type 1 charstring and turn off
hinting.
This reduces redundancy and increases synergy; it also reduces the
number of header files.
* include/freetype/config/ftheader.h (FT_DRIVER_H): New macro.
(FT_AUTOHINTER_H, FT_CFF_DRIVER_H, FT_TRUETYPE_DRIVER_H,
FT_PCF_DRIVER_H, FT_TYPE1_DRIVER_H): Make them aliases to
FT_DRIVER_H.
* include/freetype/ftautoh.h, include/freetype/ftcffdrv.h,
include/freetype/ftpcfdrv.h, include/freetype/ftt1drv.h,
include/freetype/ftttdrv.h: Replaced with...
* include/freetype/ftdriver.h: ...this new file.
(FT_CFF_HINTING_ADOBE, FT_T1_HINTING_ADOBE): Renamed to...
(FT_HINTING_ADOBE): ... this new macro.
(FT_CFF_HINTING_FREETYPE, FT_T1_HINTING_FREETYPE): Renamed to...
(FT_HINTING_FREETYPE): ... this new macro.
* src/*/*: Updated accordingly.
* include/freetype/internal/fttrace.h: Remove unused tracing macros.
s/pshalgo2/pshalgo/.
Add `trace_cffdecode'.
* src/pshinter/pshalgo.c (FT_COMPONENT): Updated.
* src/cff/cffload.c: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/cff/cffobjs.c: Include FT_SERVICE_METRICS_VARIATIONS_H and
FT_SERVICE_CFF_TABLE_LOAD_H.
* src/cid/cidriver.c: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/psaux/cffdecode.c: Include FT_FREETYPE_H and
FT_INTERNAL_DEBUG_H.
(FT_COMPONENT): Define.
* src/psaux/cffdecode.h: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
* src/psaux/psauxmod.h: Include FT_INTERNAL_POSTSCRIPT_AUX_H.
Declare `cff_builder_funcs' and `ps_builder_funcs'.
* src/psaux/psft.c: Include `psobjs.h' and `cffdecode.h'.
* src/psaux/psobjs.c : Include `psauxmod.h'.
Glyph advance widths were being written to the new `PS_Decoder' but not
saved to the underlying format specific decoder. This caused pure CFF
fonts to have bad advance width.
* include/freetype/internal/psaux.h (PS_Decoder): Change `glyph_width'
field to pointer.
Remove unused fields.
* src/psaux/psobjs.c (ps_decoder_init): Change `glyph_width' from copy
to reference.
Remove unused.
* src/psaux/psft.c (cf2_setGlyphWidth): Update code.
The interpreter in Type 1 mode rewinds the charstring after collecting
all hints for building the initial hintmap (commit d52dd7f). However,
some charstrings use `endchar' in a final subroutine call, rewinding to
the start of that subroutine, and only a small section of the actual
glyph is drawn.
* src/psaux/psintrp.c (cf2_interpT2CharString) <cf2_cmdENDCHAR>:
Ensure we are on the top level charstring before rewinding.
This controls whether the old Type 1 engine gets compiled into FreeType.
It is disabled by default.
* devel/ftoption.h, include/freetype/config/ftoption.h
(T1_CONFIG_OPTION_OLD_ENGINE): New macro.
* include/freetype/internal/psaux.h (PS_Decoder): Remove unused field.
* include/freetype/internal/psaux.h, src/cid/cidgload.c
(cid_load_glyph), src/psaux/psauxmod.c, src/psaux/psobjs.c
(ps_builder_add_point), src/psaux/t1decode.c
(t1_lookup_glyph_by_stdcharcode, t1_decoder_parse_glyph,
t1operator_seac, t1_decoder_parse_charstrings), src/psaux/t1decode.h,
src/type1/t1gload.c (T1_Parse_Glyph_And_Get_Char_String): Surround
relevant code with macro.
Minor code changes.
Duplicate the fast advance width calculations from the old parser. This
is to facilitate adding options for compiling out the old parser.
* src/psaux/t1decode.{c,h} (t1_decoder_parse_metrics): New function.
* include/freetype/internal/psaux.h (T1_Decoder_Funcs): New entry
`parse_metrics'.
* src/psaux/psauxmod.c: Set the new entry.
* src/type1/t1gload.c (T1_Parse_Glyph_And_Get_Char_String),
src/cid/cidgload.c (cid_load_glyph): Separate
conditional for selecting engine.
