summaryrefslogtreecommitdiffstats
path: root/src/sfnt/ttsbit.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/sfnt/ttsbit.c')
-rw-r--r--src/sfnt/ttsbit.c169
1 files changed, 132 insertions, 37 deletions
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index 143f276..09260b8 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -104,7 +104,8 @@
version = FT_NEXT_LONG( p );
num_strikes = FT_NEXT_ULONG( p );
- if ( ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00020000UL )
+ if ( ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00020000UL &&
+ ( (FT_ULong)version & 0xFFFF0000UL ) != 0x00030000UL )
{
error = FT_THROW( Unknown_File_Format );
goto Exit;
@@ -247,6 +248,8 @@
case TT_SBIT_TABLE_TYPE_CBLC:
{
FT_Byte* strike;
+ FT_Char max_before_bl;
+ FT_Char min_after_bl;
strike = face->sbit_table + 8 + strike_index * 48;
@@ -254,26 +257,83 @@
metrics->x_ppem = (FT_UShort)strike[44];
metrics->y_ppem = (FT_UShort)strike[45];
- metrics->ascender = (FT_Char)strike[16] << 6; /* hori.ascender */
- metrics->descender = (FT_Char)strike[17] << 6; /* hori.descender */
- metrics->height = metrics->ascender - metrics->descender;
+ metrics->ascender = (FT_Char)strike[16] * 64; /* hori.ascender */
+ metrics->descender = (FT_Char)strike[17] * 64; /* hori.descender */
+
+ /* Due to fuzzy wording in the EBLC documentation, we find both */
+ /* positive and negative values for `descender'. Additionally, */
+ /* many fonts have both `ascender' and `descender' set to zero */
+ /* (which is definitely wrong). MS Windows simply ignores all */
+ /* those values... For these reasons we apply some heuristics */
+ /* to get a reasonable, non-zero value for the height. */
+
+ max_before_bl = (FT_Char)strike[24];
+ min_after_bl = (FT_Char)strike[25];
+
+ if ( metrics->descender > 0 )
+ {
+ /* compare sign of descender with `min_after_bl' */
+ if ( min_after_bl < 0 )
+ metrics->descender = -metrics->descender;
+ }
+
+ else if ( metrics->descender == 0 )
+ {
+ if ( metrics->ascender == 0 )
+ {
+ FT_TRACE2(( "tt_face_load_strike_metrics:"
+ " sanitizing invalid ascender and descender\n"
+ " "
+ " values for strike (%d, %d)\n",
+ metrics->x_ppem, metrics->y_ppem ));
+
+ /* sanitize buggy ascender and descender values */
+ if ( max_before_bl || min_after_bl )
+ {
+ metrics->ascender = max_before_bl * 64;
+ metrics->descender = min_after_bl * 64;
+ }
+ else
+ {
+ metrics->ascender = metrics->y_ppem * 64;
+ metrics->descender = 0;
+ }
+ }
+ }
+
+#if 0
+ else
+ ; /* if we have a negative descender, simply use it */
+#endif
+
+ metrics->height = metrics->ascender - metrics->descender;
+ if ( metrics->height == 0 )
+ {
+ FT_TRACE2(( "tt_face_load_strike_metrics:"
+ " sanitizing invalid height value\n"
+ " "
+ " for strike (%d, %d)\n",
+ metrics->x_ppem, metrics->y_ppem ));
+ metrics->height = metrics->y_ppem * 64;
+ metrics->descender = metrics->ascender - metrics->height;
+ }
/* Is this correct? */
metrics->max_advance = ( (FT_Char)strike[22] + /* min_origin_SB */
strike[18] + /* max_width */
(FT_Char)strike[23] /* min_advance_SB */
- ) << 6;
+ ) * 64;
return FT_Err_Ok;
}
case TT_SBIT_TABLE_TYPE_SBIX:
{
FT_Stream stream = face->root.stream;
- FT_UInt offset, upem;
- FT_UShort ppem, resolution;
+ FT_UInt offset;
+ FT_UShort upem, ppem, resolution;
TT_HoriHeader *hori;
FT_ULong table_size;
- FT_Pos ppem_, upem_; /* to reduce casts */
+ FT_Pos ppem_; /* to reduce casts */
FT_Error error;
FT_Byte* p;
@@ -307,14 +367,16 @@
metrics->y_ppem = ppem;
ppem_ = (FT_Pos)ppem;
- upem_ = (FT_Pos)upem;
- metrics->ascender = ppem_ * hori->Ascender * 64 / upem_;
- metrics->descender = ppem_ * hori->Descender * 64 / upem_;
- metrics->height = ppem_ * ( hori->Ascender -
- hori->Descender +
- hori->Line_Gap ) * 64 / upem_;
- metrics->max_advance = ppem_ * hori->advance_Width_Max * 64 / upem_;
+ metrics->ascender =
+ FT_MulDiv( hori->Ascender, ppem_ * 64, upem );
+ metrics->descender =
+ FT_MulDiv( hori->Descender, ppem_ * 64, upem );
+ metrics->height =
+ FT_MulDiv( hori->Ascender - hori->Descender + hori->Line_Gap,
+ ppem_ * 64, upem );
+ metrics->max_advance =
+ FT_MulDiv( hori->advance_Width_Max, ppem_ * 64, upem );
return error;
}
@@ -547,13 +609,16 @@
tt_sbit_decoder_load_image( TT_SBitDecoder decoder,
FT_UInt glyph_index,
FT_Int x_pos,
- FT_Int y_pos );
+ FT_Int y_pos,
+ FT_UInt recurse_count );
- typedef FT_Error (*TT_SBitDecoder_LoadFunc)( TT_SBitDecoder decoder,
- FT_Byte* p,
- FT_Byte* plimit,
- FT_Int x_pos,
- FT_Int y_pos );
+ typedef FT_Error (*TT_SBitDecoder_LoadFunc)(
+ TT_SBitDecoder decoder,
+ FT_Byte* p,
+ FT_Byte* plimit,
+ FT_Int x_pos,
+ FT_Int y_pos,
+ FT_UInt recurse_count );
static FT_Error
@@ -561,7 +626,8 @@
FT_Byte* p,
FT_Byte* limit,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
FT_Error error = FT_Err_Ok;
FT_Byte* line;
@@ -569,6 +635,8 @@
FT_UInt bit_height, bit_width;
FT_Bitmap* bitmap;
+ FT_UNUSED( recurse_count );
+
/* check that we can write the glyph into the bitmap */
bitmap = decoder->bitmap;
@@ -700,7 +768,8 @@
FT_Byte* p,
FT_Byte* limit,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
FT_Error error = FT_Err_Ok;
FT_Byte* line;
@@ -709,6 +778,8 @@
FT_Bitmap* bitmap;
FT_UShort rval;
+ FT_UNUSED( recurse_count );
+
/* check that we can write the glyph into the bitmap */
bitmap = decoder->bitmap;
@@ -738,6 +809,12 @@
goto Exit;
}
+ if ( !line_bits || !height )
+ {
+ /* nothing to do */
+ goto Exit;
+ }
+
/* now do the blit */
/* adjust `line' to point to the first byte of the bitmap */
@@ -824,7 +901,8 @@
FT_Byte* p,
FT_Byte* limit,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
FT_Error error = FT_Err_Ok;
FT_UInt num_components, nn;
@@ -858,8 +936,11 @@
/* NB: a recursive call */
- error = tt_sbit_decoder_load_image( decoder, gindex,
- x_pos + dx, y_pos + dy );
+ error = tt_sbit_decoder_load_image( decoder,
+ gindex,
+ x_pos + dx,
+ y_pos + dy,
+ recurse_count + 1 );
if ( error )
break;
}
@@ -891,11 +972,14 @@
FT_Byte* p,
FT_Byte* limit,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
FT_Error error = FT_Err_Ok;
FT_ULong png_len;
+ FT_UNUSED( recurse_count );
+
if ( limit - p < 4 )
{
@@ -937,7 +1021,8 @@
FT_ULong glyph_start,
FT_ULong glyph_size,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
FT_Error error;
FT_Stream stream = decoder->stream;
@@ -947,7 +1032,8 @@
/* seek into the EBDT table now */
- if ( glyph_start + glyph_size > decoder->ebdt_size )
+ if ( !glyph_size ||
+ glyph_start + glyph_size > decoder->ebdt_size )
{
error = FT_THROW( Invalid_Argument );
goto Exit;
@@ -1063,7 +1149,7 @@
goto Fail;
}
- error = loader( decoder, p, p_limit, x_pos, y_pos );
+ error = loader( decoder, p, p_limit, x_pos, y_pos, recurse_count );
}
Fail:
@@ -1078,13 +1164,9 @@
tt_sbit_decoder_load_image( TT_SBitDecoder decoder,
FT_UInt glyph_index,
FT_Int x_pos,
- FT_Int y_pos )
+ FT_Int y_pos,
+ FT_UInt recurse_count )
{
- /*
- * First, we find the correct strike range that applies to this
- * glyph index.
- */
-
FT_Byte* p = decoder->eblc_base + decoder->strike_index_array;
FT_Byte* p_limit = decoder->eblc_limit;
FT_ULong num_ranges = decoder->strike_index_count;
@@ -1092,6 +1174,17 @@
FT_ULong image_start = 0, image_end = 0, image_offset;
+ /* arbitrary recursion limit */
+ if ( recurse_count > 100 )
+ {
+ FT_TRACE4(( "tt_sbit_decoder_load_image:"
+ " recursion depth exceeded\n" ));
+ goto Failure;
+ }
+
+
+ /* First, we find the correct strike range that applies to this */
+ /* glyph index. */
for ( ; num_ranges > 0; num_ranges-- )
{
start = FT_NEXT_USHORT( p );
@@ -1256,7 +1349,8 @@
image_start,
image_end,
x_pos,
- y_pos );
+ y_pos,
+ recurse_count );
Failure:
return FT_THROW( Invalid_Table );
@@ -1419,6 +1513,7 @@
error = tt_sbit_decoder_load_image( decoder,
glyph_index,
0,
+ 0,
0 );
tt_sbit_decoder_done( decoder );
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-26 02:18:49 +0000