Upgrade freetype to 2.4.6cm-7.1.0gingerbread-releasegingerbreadgb-release-7.2

CHANGES BETWEEN 2.4.5 and 2.4.6

  I. IMPORTANT BUG FIXES

    - For TrueType based fonts, the ascender and descender values were
      incorrect sometimes  (off by a pixel if the ppem value was not a
      multiple of 5).   Depending on the use you might now  experience
      a different  layout; the  change should  result in  better, more
      consistent line spacing.

    - Fix CVE-2011-0226  which causes a  vulnerability while  handling
      Type 1 fonts.

    - BDF fonts  containing  glyphs with negative values  for ENCODING
      were  incorrectly  rejected.  This  bug has  been introduced  in
      FreeType version 2.2.0.

    - David Bevan contributed a major revision of the FreeType stroker
      code:

      . The behaviour of FT_STROKER_LINEJOIN_BEVEL has been corrected.

      . A new  line join style,  FT_STROKER_LINEJOIN_MITER_FIXED,  has
        been introduced to support PostScript and PDF miter joins.

      . FT_STROKER_LINEJOIN_MITER_VARIABLE  has been introduced  as an
        alias for FT_STROKER_LINEJOIN_MITER.

      . Various stroking glitches has been fixed.

  II. MISCELLANEOUS

      - SFNT bitmap fonts which contain an outline glyph for `.notdef'
        only no longer set the FT_FACE_FLAG_SCALABLE flag.


CHANGES BETWEEN 2.4.4 and 2.4.5

  I. IMPORTANT BUG FIXES

    - A rendering regression  for second-order Bézier curves  has been
      fixed, introduced in 2.4.3.


  II. IMPORTANT CHANGES

    - If autohinting  is not  explicitly disabled,  FreeType now  uses
      the autohinter if  a TrueType based font doesn't  contain native
      hints.

    - The load flag FT_LOAD_IGNORE_GLOBAL_ADVANCE_WIDTH  has been made
      redundant and  is simply ignored;  this means that FreeType  now
      ignores the global advance width value in TrueType fonts.

  III. MISCELLANEOUS

    - `FT_Sfnt_Table_Info' can now return the number of SFNT tables of
      a font.

    - Support for PCF files compressed with bzip2 has been contributed
      by Joel  Klinghed.  To  make this  work, the  OS must  provide a
      bzip2 library.

    - Bradley  Grainger  contributed  project  and  solution  files in
      Visual Studio 2010 format.

    - Again some fixes to better handle broken fonts.

    - Some improvements to the B/W rasterizer.

    - Fixes to the cache module to improve robustness.

    - Just  Fill Bugs contributed (experimental) code to compute  blue
      zones for CJK Ideographs, improving the alignment of  horizontal
      stems at the top or bottom edges.

    - The `ftgrid' demo program  can now display  autohinter segments,
      to be toggled on and off with key `s'.


CHANGES BETWEEN 2.4.3 and 2.4.4

  I. IMPORTANT BUG FIXES

    - UVS support (TrueType/OpenType cmap format 14) support is fixed.
      This regression has been introduced in version 2.4.0.

  II. MISCELLANEOUS

    - Detect tricky fonts (e.g. MingLiU)  by the lengths and checksums
      of Type42-persistent subtables (`cvt ', `fpgm', and `prep') when
      a TrueType font without family name is given.  The previous fix,
      introduced in 2.4.3,  was too rigorous,  causing many  subsetted
      fonts (mainly  from PDF files) displayed badly  because FreeType
      forced  rendering with  the TrueType bytecode engine  instead of
      the autohinter.

    - Better support for 64bit platforms.

    - More fixes to improve handling of broken fonts.


CHANGES BETWEEN 2.4.2 and 2.4.3

  I. IMPORTANT BUG FIXES

    - Fix rendering of certain cubic, S-shaped arcs.   This regression
      has been introduced in version 2.4.0.

  II. MISCELLANEOUS

    - To  fix  the  above  mentioned  rendering  issue,  a  new spline
      flattening algorithm  has been  introduced which  speeds up both
      conic and cubic arcs.

    - Handling of broken fonts has been further improved.

Change-Id: Ie06b74b29738a34d686ab1132e9fa44d5d258d1c

6 files changed, 120 insertions, 57 deletions

diff --git a/src/cff/cffdrivr.c b/src/cff/cffdrivr.c
index 39f04ee..4fd3436 100644
--- a/src/cff/cffdrivr.c
+++ b/src/cff/cffdrivr.c
@@ -328,7 +328,7 @@
     if ( cff && cff->font_info == NULL )
     {
       CFF_FontRecDict  dict   = &cff->top_font.font_dict;
-      PS_FontInfoRec  *font_info;
+      PS_FontInfoRec  *font_info = NULL;
       FT_Memory        memory = face->root.memory;
 
 
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index e99ee70..cb06bdf 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -4,8 +4,7 @@
 /*                                                                         */
 /*    OpenType Glyph Loader (body).                                        */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
-/*            2010 by                                                      */
+/*  Copyright 1996-2011 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -1159,8 +1158,8 @@
               op = cff_op_flex1;
               break;
             default:
-              /* decrement ip for syntax error message */
-              ip--;
+              FT_TRACE4(( " unknown op (12, %d)\n", v ));
+              break;
             }
           }
           break;
@@ -1213,11 +1212,12 @@
           op = cff_op_hvcurveto;
           break;
         default:
+          FT_TRACE4(( " unknown op (%d)\n", v ));
           break;
         }
 
         if ( op == cff_op_unknown )
-          goto Syntax_Error;
+          continue;
 
         /* check arguments */
         req_args = cff_argument_counts[op];
@@ -1438,9 +1438,14 @@
             FT_TRACE4(( op == cff_op_hlineto ? " hlineto\n"
                                              : " vlineto\n" ));
 
-            if ( num_args < 1 )
+            if ( num_args < 0 )
               goto Stack_Underflow;
 
+            /* there exist subsetted fonts (found in PDFs) */
+            /* which call `hlineto' without arguments      */
+            if ( num_args == 0 )
+              break;
+
             if ( cff_builder_start_point ( builder, x, y ) ||
                  check_points( builder, num_args )         )
               goto Fail;
@@ -2701,7 +2706,7 @@
                                               glyph_index );
 
       if ( fd_index >= cff->num_subfonts ) 
-        fd_index = cff->num_subfonts - 1;
+        fd_index = (FT_Byte)( cff->num_subfonts - 1 );
 
       top_upm = cff->top_font.font_dict.units_per_em;
       sub_upm = cff->subfonts[fd_index]->font_dict.units_per_em;
diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index 42e7730..98d8e1c 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -387,7 +387,7 @@
   {
     FT_Error   error     = CFF_Err_Ok;
     FT_Memory  memory    = idx->stream->memory;
-    FT_Byte**  t;
+    FT_Byte**  t = NULL;
     FT_Byte*   new_bytes = NULL;
 
 
@@ -519,6 +519,18 @@
         }
       }
 
+      /* XXX: should check off2 does not exceed the end of this entry; */
+      /*      at present, only truncate off2 at the end of this stream */
+      if ( off2 > stream->size + 1                    ||
+           idx->data_offset > stream->size - off2 + 1 )
+      {
+        FT_ERROR(( "cff_index_access_element:"
+                   " offset to next entry (%d)"
+                   " exceeds the end of stream (%d)\n",
+                   off2, stream->size - idx->data_offset + 1 ));
+        off2 = stream->size - idx->data_offset + 1;
+      }
+
       /* access element */
       if ( off1 && off2 > off1 )
       {
@@ -779,11 +791,12 @@
       goto Exit;
 
     for ( i = 0; i < num_glyphs; i++ )
+    {
       if ( charset->sids[i] > max_cid )
         max_cid = charset->sids[i];
-    max_cid++;
+    }
 
-    if ( FT_NEW_ARRAY( charset->cids, max_cid ) )
+    if ( FT_NEW_ARRAY( charset->cids, (FT_ULong)max_cid + 1 ) )
       goto Exit;
 
     /* When multiple GIDs map to the same CID, we choose the lowest */
@@ -807,7 +820,7 @@
     FT_UInt  result = 0;
 
 
-    if ( cid < charset->max_cid )
+    if ( cid <= charset->max_cid )
       result = charset->cids[cid];
 
     return result;
@@ -881,20 +894,7 @@
             goto Exit;
 
           for ( j = 1; j < num_glyphs; j++ )
-          {
-            FT_UShort sid = FT_GET_USHORT();
-
-
-            /* this constant is given in the CFF specification */
-            if ( sid < 65000L )
-              charset->sids[j] = sid;
-            else
-            {
-              FT_TRACE0(( "cff_charset_load:"
-                          " invalid SID value %d set to zero\n", sid ));
-              charset->sids[j] = 0;
-            }
-          }
+            charset->sids[j] = FT_GET_USHORT();
 
           FT_FRAME_EXIT();
         }
@@ -927,20 +927,12 @@
                 goto Exit;
             }
 
-            /* check whether the range contains at least one valid glyph; */
-            /* the constant is given in the CFF specification             */
-            if ( glyph_sid >= 65000L )
-            {
-              FT_ERROR(( "cff_charset_load: invalid SID range\n" ));
-              error = CFF_Err_Invalid_File_Format;
-              goto Exit;
-            }
-
             /* try to rescue some of the SIDs if `nleft' is too large */
-            if ( nleft > 65000L - 1L || glyph_sid >= 65000L - nleft )
+            if ( glyph_sid > 0xFFFFL - nleft )
             {
-              FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" ));
-              nleft = ( FT_UInt )( 65000L - 1L - glyph_sid );
+              FT_ERROR(( "cff_charset_load: invalid SID range trimmed"
+                         " nleft=%d -> %d\n", nleft, 0xFFFFL - glyph_sid ));
+              nleft = ( FT_UInt )( 0xFFFFL - glyph_sid );
             }
 
             /* Fill in the range of sids -- `nleft + 1' glyphs. */
@@ -1277,9 +1269,7 @@
           if ( gid != 0 )
           {
             encoding->codes[j] = (FT_UShort)gid;
-
-            if ( encoding->count < j + 1 )
-              encoding->count = j + 1;
+            encoding->count    = j + 1;
           }
           else
           {
@@ -1524,7 +1514,7 @@
     if ( dict->cid_registry != 0xFFFFU )
     {
       CFF_IndexRec  fd_index;
-      CFF_SubFont   sub;
+      CFF_SubFont   sub = NULL;
       FT_UInt       idx;
 
 
diff --git a/src/cff/cffobjs.c b/src/cff/cffobjs.c
index f8b07c3..cd38676 100644
--- a/src/cff/cffobjs.c
+++ b/src/cff/cffobjs.c
@@ -4,8 +4,7 @@
 /*                                                                         */
 /*    OpenType objects manager (body).                                     */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
-/*            2010 by                                                      */
+/*  Copyright 1996-2011 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -162,7 +161,7 @@
     {
       CFF_Face      face     = (CFF_Face)cffsize->face;
       CFF_Font      font     = (CFF_Font)face->extra.data;
-      CFF_Internal  internal;
+      CFF_Internal  internal = NULL;
 
       PS_PrivateRec  priv;
       FT_Memory      memory = cffsize->face->memory;
@@ -421,6 +420,7 @@
         {
           for ( idx = 7; idx < length; idx++ )
             name[idx - 7] = name[idx];
+          length -= 7;
         }
       }
       else
@@ -429,6 +429,51 @@
   }
 
 
+  /* Remove the style part from the family name (if present). */
+
+  static void
+  remove_style( FT_String*        family_name,
+                const FT_String*  style_name )
+  {
+    FT_Int32  family_name_length, style_name_length;
+
+
+    family_name_length = strlen( family_name );
+    style_name_length  = strlen( style_name );
+
+    if ( family_name_length > style_name_length )
+    {
+      FT_Int  idx;
+
+
+      for ( idx = 1; idx <= style_name_length; ++idx )
+      {
+        if ( family_name[family_name_length - idx] !=
+             style_name[style_name_length - idx] )
+          break;
+      }
+
+      if ( idx > style_name_length )
+      {
+        /* family_name ends with style_name; remove it */
+        idx = family_name_length - style_name_length - 1;
+
+        /* also remove special characters     */
+        /* between real family name and style */
+        while ( idx > 0                     &&
+                ( family_name[idx] == '-' ||
+                  family_name[idx] == ' ' ||
+                  family_name[idx] == '_' ||
+                  family_name[idx] == '+' ) )
+          --idx;
+
+        if ( idx > 0 )
+          family_name[idx + 1] = '\0';
+      }
+    }
+  }
+
+
   FT_LOCAL_DEF( FT_Error )
   cff_face_init( FT_Stream      stream,
                  FT_Face        cffface,        /* CFF_Face */
@@ -436,14 +481,14 @@
                  FT_Int         num_params,
                  FT_Parameter*  params )
   {
-    CFF_Face            face = (CFF_Face)cffface;
+    CFF_Face            face        = (CFF_Face)cffface;
     FT_Error            error;
     SFNT_Service        sfnt;
     FT_Service_PsCMaps  psnames;
     PSHinter_Service    pshinter;
     FT_Bool             pure_cff    = 1;
     FT_Bool             sfnt_format = 0;
-    FT_Library library = cffface->driver->root.library;
+    FT_Library          library     = cffface->driver->root.library;
 
 
     sfnt = (SFNT_Service)FT_Get_Module_Interface(
@@ -523,7 +568,7 @@
 
     /* now load and parse the CFF table in the file */
     {
-      CFF_Font         cff;
+      CFF_Font         cff = NULL;
       CFF_FontRecDict  dict;
       FT_Memory        memory = cffface->memory;
       FT_Int32         flags;
@@ -677,7 +722,7 @@
 
         /* compute number of glyphs */
         if ( dict->cid_registry != 0xFFFFU )
-          cffface->num_glyphs = cff->charset.max_cid;
+          cffface->num_glyphs = cff->charset.max_cid + 1;
         else
           cffface->num_glyphs = cff->charstrings_index.count;
 
@@ -758,6 +803,9 @@
                 /* case, the remaining string in `fullp' will be used as */
                 /* the style name.                                       */
                 style_name = cff_strcpy( memory, fullp );
+
+                /* remove the style part from the family name (if present) */
+                remove_style( cffface->family_name, style_name ); 
               }
               break;
             }
diff --git a/src/cff/cffparse.c b/src/cff/cffparse.c
index 0d11a72..4f71e85 100644
--- a/src/cff/cffparse.c
+++ b/src/cff/cffparse.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    CFF token stream parser (body)                                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2007, 2008, 2009, 2010 by       */
+/*  Copyright 1996-2004, 2007-2011 by                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -35,8 +35,6 @@
 #define FT_COMPONENT  trace_cffparse
 
 
-
-
   FT_LOCAL_DEF( void )
   cff_parser_init( CFF_Parser  parser,
                    FT_UInt     code,
@@ -475,6 +473,12 @@
       if ( scaling < 0 || scaling > 9 )
       {
         /* Return default matrix in case of unlikely values. */
+
+        FT_TRACE1(( "cff_parse_font_matrix:"
+                    " strange scaling value for xx element (%d),\n"
+                    "                      "
+                    " using default matrix\n", scaling ));
+
         matrix->xx = 0x10000L;
         matrix->yx = 0;
         matrix->yx = 0;
@@ -493,6 +497,12 @@
       offset->y  = cff_parse_fixed_scaled( data,   scaling );
 
       *upm = power_tens[scaling];
+
+      FT_TRACE4(( " font matrix: [%f %f %f %f]\n",
+                  (double)matrix->xx / *upm / 65536,
+                  (double)matrix->xy / *upm / 65536,
+                  (double)matrix->yx / *upm / 65536,
+                  (double)matrix->yy / *upm / 65536 ));
     }
 
   Exit:
@@ -518,6 +528,12 @@
       bbox->xMax = FT_RoundFix( cff_parse_fixed( data++ ) );
       bbox->yMax = FT_RoundFix( cff_parse_fixed( data   ) );
       error = CFF_Err_Ok;
+
+      FT_TRACE4(( " bbox: [%d %d %d %d]\n",
+                  bbox->xMin / 65536,
+                  bbox->yMin / 65536,
+                  bbox->xMax / 65536,
+                  bbox->yMax / 65536 ));
     }
 
     return error;
@@ -557,8 +573,8 @@
 
     if ( parser->top >= parser->stack + 3 )
     {
-      dict->cid_registry   = (FT_UInt)cff_parse_num ( data++ );
-      dict->cid_ordering   = (FT_UInt)cff_parse_num ( data++ );
+      dict->cid_registry   = (FT_UInt)cff_parse_num( data++ );
+      dict->cid_ordering   = (FT_UInt)cff_parse_num( data++ );
       if ( **data == 30 )
         FT_TRACE1(( "cff_parse_cid_ros: real supplement is rounded\n" ));
       dict->cid_supplement = cff_parse_num( data );
@@ -566,6 +582,11 @@
         FT_TRACE1(( "cff_parse_cid_ros: negative supplement %d is found\n",
                    dict->cid_supplement ));
       error = CFF_Err_Ok;
+
+      FT_TRACE4(( " ROS: registry sid %d, ordering sid %d, supplement %d\n",
+                  dict->cid_registry,
+                  dict->cid_ordering,
+                  dict->cid_supplement ));
     }
 
     return error;
diff --git a/src/cff/cfftypes.h b/src/cff/cfftypes.h
index d405357..665ab6f 100644
--- a/src/cff/cfftypes.h
+++ b/src/cff/cfftypes.h
@@ -5,7 +5,7 @@
 /*    Basic OpenType/CFF type definitions and interface (specification     */
 /*    only).                                                               */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2006, 2007, 2008, 2010 by             */
+/*  Copyright 1996-2003, 2006-2008, 2010-2011 by                           */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -212,8 +212,7 @@ FT_BEGIN_HEADER
   } CFF_SubFontRec, *CFF_SubFont;
 
 
-  /* maximum number of sub-fonts in a CID-keyed file */
-#define CFF_MAX_CID_FONTS  32
+#define CFF_MAX_CID_FONTS  256
 
 
   typedef struct  CFF_FontRec_