Commit Graph

9 Commits

Author SHA1 Message Date
Werner Lemberg
24848a3d58 [cff] Integer overflow.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2109
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2110
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2122

* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.

* src/cff/cf2hints.c (cf2_hintmap_map): Synchronize if-else
branches.
2017-06-06 12:05:04 +02:00
Werner Lemberg
addb2dddb6 [base, cff, truetype] Integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2060
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2062
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2063
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2068

* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.

* src/cff/cf2blues.c (cf2_blues_capture), src/cff/cf2hints.c
(cf2_hintmap_adjustHints): Use OVERFLOW_SUB_INT32.

* src/truetype/ttgload.c (compute_glyph_metrics): User
OVERFLOW_SUB_LONG.

* src/truetype/ttinterp.c (Direct_Move, Direct_Move_Orig,
Direct_Move_X, Direct_Move_Y, Direct_Move_Orig_X,
Direct_Move_Orig_Y, Move_Zp2_Point, Ins_MSIRP): Use
OVERFLOW_ADD_LONG and OVERFLOW_SUB_LONG.
2017-06-03 21:05:42 +02:00
Werner Lemberg
7a4276fb90 [cff] More integer overflows.
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032

* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
2017-06-02 09:21:37 +02:00
Werner Lemberg
2e4188d833 [cff] s/cf2_floatToFixed/cf2_doubleToFixed/.
The new name better describes what the macro actually does;
additionally, we don't need a trailing `f' for literals (there was
only a single such instance in the code, but this caused a clang
warning because the macro itself uses `double' literals).

* src/cff/cf2blues.c, src/cff/cf2blues.h, src/cff/cf2fixed.h,
src/cff/cf2font.c, src/cff/cf2hints.c: Updated.
2017-05-28 07:46:22 +02:00
Alexei Podtelezhnikov
6adda68a75 Math simplifications.
* src/cf2blues.c (cf2_blues_init): Use `FT_MulDiv'.
* src/cf2ft.c (cf2_getScaleAndHintFlag): Use simple division.
2014-02-28 09:25:57 +01:00
Werner Lemberg
e8ed2d621e Another round of cppcheck nitpicks.
The call was (from the top-level of the FreeType tree):

  cppcheck --force \
           --enable=all \
           -I /usr/include \
           -I /usr/local/include \
           -I /usr/lib/gcc/i586-suse-linux/4.7/include \
           -I include \
           -I include/freetype \
           -I include/freetype/config \
           -I include/freetype/internal \
           -DFT2_BUILD_LIBRARY \
           . &> cppcheck.log

using cppcheck git commit f7e93f99.

Note that cppcheck still can't handle `#include FOO' (with `FOO' a
macro).

*/* Improve variable scopes.
*/* Remove redundant initializations which get overwritten.

* src/gxvalid/*: Comment out redundant code or guard it with
FT_DEBUG_LEVEL_TRACE.
2013-08-01 12:20:20 +02:00
Werner Lemberg
77c39b1deb [cff] Make Adobe CFF engine work correctly on 64bit hosts.
Reported by numerous people on the `freetype-devel' list.  Without
this fix, glyphs aren't properly aligned on a common baseline.

On 64bit systems, `FT_Pos' expands to `long int', having a width of
64bit.  `CF2_Fixed' expands to `int' which is normally 32bit wide on
64bit hosts also.  Wrong casts filled up the blues arrays with
incorrect values.  Note that all blues values are accessed with the
`cf2_blueToFixed' macro which handles the 64bit to 32bit conversion.

* src/cff/cf2ft.h (cf2_getBlueValues, cf2_getOtherBlues,
cf2_getFamilyBlues, cf2_getFamilyOtherBlues): Use `FT_Pos' for
`data', not `CF2_Fixed'.
* src/cff/cf2ft.c (cf2_getBlueValues, cf2_getOtherBlues,
cf2_getFamilyBlues, cf2_getFamilyOtherBlues): Updated.
* src/cff/cf2blues.c (cf2_blues_init): Updated.
2013-05-04 18:04:07 +02:00
Werner Lemberg
99033fefb6 * src/cff/cf2blues.c: Remove dead code. 2013-05-03 17:39:24 +02:00
Werner Lemberg
283c8ed817 [cff] New files for Adobe's Type 2 interpreter and hinting engine. 2013-04-13 15:02:31 +02:00