upgrade freetype to 2.4.2.

Bug: 2969145

Change-Id: I8debbbe0bd478d9cf8c39cff5179981b5f3b371a

8 files changed, 63 insertions, 42 deletions

diff --git a/src/sfnt/sfdriver.c b/src/sfnt/sfdriver.c
index 1097efb..b74679b 100644
--- a/src/sfnt/sfdriver.c
+++ b/src/sfnt/sfdriver.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    High-level SFNT driver interface (body).                             */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -362,7 +362,7 @@
           *acharset_registry = registry.u.atom;
         }
         else
-          error = FT_Err_Invalid_Argument;
+          error = SFNT_Err_Invalid_Argument;
       }
     }
 
@@ -436,7 +436,7 @@
     FT_UNUSED( face_index );
     FT_UNUSED( header );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -449,7 +449,7 @@
     FT_UNUSED( stream );
     FT_UNUSED( header );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -460,7 +460,7 @@
     FT_UNUSED( face );
     FT_UNUSED( stream );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -513,7 +513,7 @@
      *  is only there for some rogue clients which would want to call it
      *  directly (which doesn't make much sense).
      */
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -534,7 +534,7 @@
     FT_UNUSED( cmap );
     FT_UNUSED( input );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -545,7 +545,7 @@
     FT_UNUSED( face );
     FT_UNUSED( cmap );
 
-    return 0;
+    return SFNT_Err_Ok;
   }
 
 #endif /* FT_CONFIG_OPTION_OLD_INTERNALS */
diff --git a/src/sfnt/sfntpic.c b/src/sfnt/sfntpic.c
index fd3cf4e..53aca17 100644
--- a/src/sfnt/sfntpic.c
+++ b/src/sfnt/sfntpic.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for sfnt module.     */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -60,15 +60,16 @@
   FT_Error
   sfnt_module_class_pic_init(  FT_Library library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
-    sfntModulePIC* container;
-    FT_Memory memory = library->memory;
+    FT_PIC_Container*  pic_container = &library->pic_container;
+    FT_Error           error = SFNT_Err_Ok;
+    sfntModulePIC*     container;
+    FT_Memory          memory = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->sfnt = container;
 
     /* initialize pointer table - this is how the module usually expects this data */
diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c
index b74b1a9..6e35e2d 100644
--- a/src/sfnt/sfobjs.c
+++ b/src/sfnt/sfobjs.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    SFNT object management (base).                                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -50,9 +50,9 @@
   tt_name_entry_ascii_from_utf16( TT_NameEntry  entry,
                                   FT_Memory     memory )
   {
-    FT_String*  string;
+    FT_String*  string = NULL;
     FT_UInt     len, code, n;
-    FT_Byte*    read = (FT_Byte*)entry->string;
+    FT_Byte*    read   = (FT_Byte*)entry->string;
     FT_Error    error;
 
 
@@ -81,9 +81,9 @@
   tt_name_entry_ascii_from_other( TT_NameEntry  entry,
                                   FT_Memory     memory )
   {
-    FT_String*  string;
+    FT_String*  string = NULL;
     FT_UInt     len, code, n;
-    FT_Byte*    read = (FT_Byte*)entry->string;
+    FT_Byte*    read   = (FT_Byte*)entry->string;
     FT_Error    error;
 
 
@@ -160,7 +160,7 @@
       /* According to the OpenType 1.3 specification, only Microsoft or  */
       /* Apple platform IDs might be used in the `name' table.  The      */
       /* `Unicode' platform is reserved for the `cmap' table, and the    */
-      /* `Iso' one is deprecated.                                        */
+      /* `ISO' one is deprecated.                                        */
       /*                                                                 */
       /* However, the Apple TrueType specification doesn't say the same  */
       /* thing and goes to suggest that all Unicode `name' table entries */
diff --git a/src/sfnt/ttbdf.c b/src/sfnt/ttbdf.c
index 206cece..18845c3 100644
--- a/src/sfnt/ttbdf.c
+++ b/src/sfnt/ttbdf.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType and OpenType embedded BDF properties (body).                */
 /*                                                                         */
-/*  Copyright 2005, 2006 by                                                */
+/*  Copyright 2005, 2006, 2010 by                                          */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -74,7 +74,7 @@
          length < 8                             ||
          FT_FRAME_EXTRACT( length, bdf->table ) )
     {
-      error = FT_Err_Invalid_Table;
+      error = SFNT_Err_Invalid_Table;
       goto Exit;
     }
 
@@ -131,7 +131,7 @@
   BadTable:
     FT_FRAME_RELEASE( bdf->table );
     FT_ZERO( bdf );
-    error = FT_Err_Invalid_Table;
+    error = SFNT_Err_Invalid_Table;
     goto Exit;
   }
 
@@ -143,7 +143,7 @@
   {
     TT_BDF     bdf   = &face->bdf;
     FT_Size    size  = FT_FACE(face)->size;
-    FT_Error   error = 0;
+    FT_Error   error = SFNT_Err_Ok;
     FT_Byte*   p;
     FT_UInt    count;
     FT_Byte*   strike;
@@ -163,7 +163,7 @@
     p      = bdf->table + 8;
     strike = p + 4 * count;
 
-    error = FT_Err_Invalid_Argument;
+    error = SFNT_Err_Invalid_Argument;
 
     if ( size == NULL || property_name == NULL )
       goto Exit;
@@ -215,7 +215,7 @@
             {
               aprop->type   = BDF_PROPERTY_TYPE_ATOM;
               aprop->u.atom = (const char*)bdf->strings + value;
-              error         = 0;
+              error         = SFNT_Err_Ok;
               goto Exit;
             }
             break;
@@ -223,13 +223,13 @@
           case 0x02:
             aprop->type      = BDF_PROPERTY_TYPE_INTEGER;
             aprop->u.integer = (FT_Int32)value;
-            error            = 0;
+            error            = SFNT_Err_Ok;
             goto Exit;
 
           case 0x03:
             aprop->type       = BDF_PROPERTY_TYPE_CARDINAL;
             aprop->u.cardinal = value;
-            error             = 0;
+            error             = SFNT_Err_Ok;
             goto Exit;
 
           default:
diff --git a/src/sfnt/ttcmap.c b/src/sfnt/ttcmap.c
index b283f6d..544750a 100644
--- a/src/sfnt/ttcmap.c
+++ b/src/sfnt/ttcmap.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType character mapping table (cmap) support (body).              */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by            */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -2689,7 +2689,7 @@
                     FT_Memory  memory )
   {
     FT_UInt32 old_max = cmap->max_results;
-    FT_Error  error   = 0;
+    FT_Error  error   = SFNT_Err_Ok;
 
 
     if ( num_results > cmap->max_results )
@@ -2787,7 +2787,8 @@
         }
 
         /* and the non-default table (these glyphs are specified here) */
-        if ( nondefOff != 0 ) {
+        if ( nondefOff != 0 )
+        {
           FT_Byte*  ndp         = table + nondefOff;
           FT_ULong  numMappings = TT_NEXT_ULONG( ndp );
           FT_ULong  i, lastUni = 0;
@@ -3375,7 +3376,7 @@
     clazz[i] = NULL;
 
     *output_class = clazz;
-    return FT_Err_Ok;
+    return SFNT_Err_Ok;
   }
 
 #endif /*FT_CONFIG_OPTION_PIC*/
@@ -3391,11 +3392,12 @@
     FT_Byte*           limit = table + face->cmap_size;
     FT_UInt volatile   num_cmaps;
     FT_Byte* volatile  p     = table;
-    FT_Library         library = FT_FACE_LIBRARY(face);
-    FT_UNUSED(library);
+    FT_Library         library = FT_FACE_LIBRARY( face );
+
+    FT_UNUSED( library );
 
 
-    if ( p + 4 > limit )
+    if ( !p || p + 4 > limit )
       return SFNT_Err_Invalid_Table;
 
     /* only recognize format 0 */
@@ -3409,6 +3411,12 @@
     }
 
     num_cmaps = TT_NEXT_USHORT( p );
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+    if ( num_cmaps > FT_MAX_CHARMAP_CACHEABLE )
+      FT_ERROR(( "tt_face_build_cmaps: too many cmap subtables(%d) "
+                 "subtable#%d and later are loaded but cannot be searched\n",
+                 num_cmaps, FT_MAX_CHARMAP_CACHEABLE + 1 ));
+#endif
 
     for ( ; num_cmaps > 0 && p + 8 <= limit; num_cmaps-- )
     {
diff --git a/src/sfnt/ttkern.c b/src/sfnt/ttkern.c
index c154080..4688898 100644
--- a/src/sfnt/ttkern.c
+++ b/src/sfnt/ttkern.c
@@ -5,7 +5,7 @@
 /*    Load the basic TrueType kerning table.  This doesn't handle          */
 /*    kerning data within the GPOS table at the moment.                    */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -115,7 +115,7 @@
       num_pairs = FT_NEXT_USHORT( p );
       p        += 6;
 
-      if ( ( p_next - p ) / 6 < (int)num_pairs ) /* handle broken count */
+      if ( ( p_next - p ) < 6 * (int)num_pairs ) /* handle broken count */
         num_pairs = (FT_UInt)( ( p_next - p ) / 6 );
 
       avail |= mask;
@@ -220,7 +220,7 @@
       num_pairs = FT_NEXT_USHORT( p );
       p        += 6;
 
-      if ( ( next - p ) / 6 < (int)num_pairs )  /* handle broken count  */
+      if ( ( next - p ) < 6 * (int)num_pairs )  /* handle broken count  */
         num_pairs = (FT_UInt)( ( next - p ) / 6 );
 
       switch ( coverage >> 8 )
diff --git a/src/sfnt/ttload.c b/src/sfnt/ttload.c
index 3ad33bd..1c174af 100644
--- a/src/sfnt/ttload.c
+++ b/src/sfnt/ttload.c
@@ -5,7 +5,8 @@
 /*    Load the basic TrueType tables, i.e., tables that can be either in   */
 /*    TTF or OTF fonts (body).                                             */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -77,7 +78,8 @@
     {
       /* For compatibility with Windows, we consider    */
       /* zero-length tables the same as missing tables. */
-      if ( entry->Tag == tag ) {
+      if ( entry->Tag == tag )
+      {
         if ( entry->Length != 0 )
         {
           FT_TRACE4(( "found table.\n" ));
@@ -693,6 +695,15 @@
 
         maxProfile->maxTwilightPoints = 0xFFFFU - 4;
       }
+
+      /* we arbitrarily limit recursion to avoid stack exhaustion */
+      if ( maxProfile->maxComponentDepth > 100 )
+      {
+        FT_TRACE0(( "tt_face_load_maxp:"
+                    " abnormally large component depth (%d) set to 100\n",
+                    maxProfile->maxComponentDepth ));
+        maxProfile->maxComponentDepth = 100;
+      }
     }
 
     FT_TRACE3(( "numGlyphs: %u\n", maxProfile->numGlyphs ));
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index 833bb2a..faa8f88 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    TrueType and OpenType embedded bitmap support (body).                */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -417,7 +418,7 @@
   tt_face_load_eblc( TT_Face    face,
                      FT_Stream  stream )
   {
-    FT_Error   error  = 0;
+    FT_Error   error  = SFNT_Err_Ok;
     FT_Memory  memory = stream->memory;
     FT_Fixed   version;
     FT_ULong   num_strikes;