Update to freetype 2.4.9

This was done by applying the entire 2.4.9 except for the following exceptions:
- files that were new, or were not present originally in the version of
freetype we were using (meaning that they are present in 2.4.8, and in
2.4.9, but were never integrated into the Android tree because they are
not used in the Android tree).
- ftmodule.h: given that we support fewer modules than in upstream 2.4.9
(same as Android), the file was left unchanged (and there were no changes
from the official 2.4.8 to 2.4.9
- ftoption.h: same reasons as ftmodule.h

Change-Id: Id251f2cc5ca1c864f9a4cc0c67b94025ee3ccc4a

10 files changed, 218 insertions, 146 deletions

diff --git a/src/truetype/ttdriver.c b/src/truetype/ttdriver.c
index e70a611..3669d45 100644
--- a/src/truetype/ttdriver.c
+++ b/src/truetype/ttdriver.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType font driver implementation (body).                          */
 /*                                                                         */
-/*  Copyright 1996-2011 by                                                 */
+/*  Copyright 1996-2012 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -258,7 +258,7 @@
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
-  /*    Load_Glyph                                                         */
+  /*    tt_glyph_load                                                      */
   /*                                                                       */
   /* <Description>                                                         */
   /*    A driver method used to load a glyph within a given glyph slot.    */
@@ -282,10 +282,10 @@
   /*    FreeType error code.  0 means success.                             */
   /*                                                                       */
   static FT_Error
-  Load_Glyph( FT_GlyphSlot  ttslot,         /* TT_GlyphSlot */
-              FT_Size       ttsize,         /* TT_Size      */
-              FT_UInt       glyph_index,
-              FT_Int32      load_flags )
+  tt_glyph_load( FT_GlyphSlot  ttslot,      /* TT_GlyphSlot */
+                 FT_Size       ttsize,      /* TT_Size      */
+                 FT_UInt       glyph_index,
+                 FT_Int32      load_flags )
   {
     TT_GlyphSlot  slot = (TT_GlyphSlot)ttslot;
     TT_Size       size = (TT_Size)ttsize;
@@ -313,7 +313,7 @@
     if ( load_flags & FT_LOAD_NO_HINTING )
     {
       /* both FT_LOAD_NO_HINTING and FT_LOAD_NO_AUTOHINT   */
-      /* are necessary to disable hinting for tricky fonts */          
+      /* are necessary to disable hinting for tricky fonts */
 
       if ( FT_IS_TRICKY( face ) )
         load_flags &= ~FT_LOAD_NO_HINTING;
@@ -402,19 +402,35 @@
   tt_get_interface( FT_Module    driver,    /* TT_Driver */
                     const char*  tt_interface )
   {
+    FT_Library           library;
     FT_Module_Interface  result;
     FT_Module            sfntd;
     SFNT_Service         sfnt;
 
+
+    /* FT_TT_SERVICES_GET derefers `library' in PIC mode */
+#ifdef FT_CONFIG_OPTION_PIC
+    if ( !driver )
+      return NULL;
+    library = driver->library;
+    if ( !library )
+      return NULL;
+#endif
+
     result = ft_service_list_lookup( FT_TT_SERVICES_GET, tt_interface );
     if ( result != NULL )
       return result;
 
+#ifndef FT_CONFIG_OPTION_PIC
     if ( !driver )
       return NULL;
+    library = driver->library;
+    if ( !library )
+      return NULL;
+#endif
 
     /* only return the default interface from the SFNT module */
-    sfntd = FT_Get_Module( driver->library, "sfnt" );
+    sfntd = FT_Get_Module( library, "sfnt" );
     if ( sfntd )
     {
       sfnt = (SFNT_Service)( sfntd->clazz->module_interface );
@@ -440,11 +456,10 @@
 #define TT_SIZE_SELECT    0
 #endif
 
-  FT_DEFINE_DRIVER(tt_driver_class,
-  
-    
-      FT_MODULE_FONT_DRIVER        |
-      FT_MODULE_DRIVER_SCALABLE    |
+  FT_DEFINE_DRIVER( tt_driver_class,
+
+      FT_MODULE_FONT_DRIVER     |
+      FT_MODULE_DRIVER_SCALABLE |
       TT_HINTER_FLAG,
 
       sizeof ( TT_DriverRec ),
@@ -468,15 +483,15 @@
     tt_size_init,
     tt_size_done,
     tt_slot_init,
-    0,                      /* FT_Slot_DoneFunc */
+    0,                       /* FT_Slot_DoneFunc */
 
-    ft_stub_set_char_sizes, /* FT_CONFIG_OPTION_OLD_INTERNALS */
+    ft_stub_set_char_sizes,  /* FT_CONFIG_OPTION_OLD_INTERNALS */
     ft_stub_set_pixel_sizes, /* FT_CONFIG_OPTION_OLD_INTERNALS */
 
-    Load_Glyph,
+    tt_glyph_load,
 
     tt_get_kerning,
-    0,                      /* FT_Face_AttachFunc      */
+    0,                       /* FT_Face_AttachFunc */
     tt_get_advances,
 
     tt_size_request,
diff --git a/src/truetype/tterrors.h b/src/truetype/tterrors.h
index d317c70..78d138f 100644
--- a/src/truetype/tterrors.h
+++ b/src/truetype/tterrors.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType error codes (specification only).                           */
 /*                                                                         */
-/*  Copyright 2001 by                                                      */
+/*  Copyright 2001, 2012 by                                                */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -30,6 +30,7 @@
 
 #undef __FTERRORS_H__
 
+#undef  FT_ERR_PREFIX
 #define FT_ERR_PREFIX  TT_Err_
 #define FT_ERR_BASE    FT_Mod_Err_TrueType
 
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index f35521e..ce8c888 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType Glyph Loader (body).                                        */
 /*                                                                         */
-/*  Copyright 1996-2011                                                    */
+/*  Copyright 1996-2012                                                    */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -362,19 +362,21 @@
     if ( n_contours >= 0xFFF || p + ( n_contours + 1 ) * 2 > limit )
       goto Invalid_Outline;
 
-    prev_cont = FT_NEXT_USHORT( p );
+    prev_cont = FT_NEXT_SHORT( p );
 
     if ( n_contours > 0 )
       cont[0] = prev_cont;
 
+    if ( prev_cont < 0 )
+      goto Invalid_Outline;
+
     for ( cont++; cont < cont_limit; cont++ )
     {
-      cont[0] = FT_NEXT_USHORT( p );
+      cont[0] = FT_NEXT_SHORT( p );
       if ( cont[0] <= prev_cont )
       {
         /* unordered contours: this is invalid */
-        error = TT_Err_Invalid_Table;
-        goto Fail;
+        goto Invalid_Outline;
       }
       prev_cont = cont[0];
     }
@@ -392,13 +394,6 @@
     if ( error )
       goto Fail;
 
-    /* we'd better check the contours table right now */
-    outline = &gloader->current.outline;
-
-    for ( cont = outline->contours + 1; cont < cont_limit; cont++ )
-      if ( cont[-1] >= cont[0] )
-        goto Invalid_Outline;
-
     /* reading the bytecode instructions */
     load->glyph->control_len  = 0;
     load->glyph->control_data = 0;
@@ -439,6 +434,8 @@
 
     p += n_ins;
 
+    outline = &gloader->current.outline;
+
     /* reading the point tags */
     flag       = (FT_Byte*)outline->tags;
     flag_limit = flag + n_points;
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index c62c589..3acb24a 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType bytecode interpreter (body).                                */
 /*                                                                         */
-/*  Copyright 1996-2011                                                    */
+/*  Copyright 1996-2012                                                    */
 /*  by David Turner, Robert Wilhelm, and Werner Lemberg.                   */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -715,7 +715,7 @@
     FT_Error  error;
 
 
-    if ( ( error = TT_Goto_CodeRange( exec, tt_coderange_glyph, 0  ) )
+    if ( ( error = TT_Goto_CodeRange( exec, tt_coderange_glyph, 0 ) )
            != TT_Err_Ok )
       return error;
 
@@ -1800,7 +1800,7 @@
 
     /* NOTE: Because the last instruction of a program may be a CALL */
     /*       which will return to the first byte *after* the code    */
-    /*       range, we test for AIP <= Size, instead of AIP < Size.  */
+    /*       range, we test for aIP <= Size, instead of aIP < Size.  */
 
     if ( aIP > range->size )
     {
@@ -2757,7 +2757,7 @@
     W = Vx * Vx + Vy * Vy;
 
     /* Now, we want that Sqrt( W ) = 0x4000 */
-    /* Or 0x10000000 <= W < 0x10004000        */
+    /* Or 0x10000000 <= W < 0x10004000      */
 
     if ( Vx < 0 )
     {
@@ -3199,36 +3199,42 @@
   }
 
 
-#define DO_JROT                            \
-    if ( args[1] != 0 )                    \
-    {                                      \
-      if ( args[0] == 0 && CUR.args == 0 ) \
-        CUR.error = TT_Err_Bad_Argument;   \
-      CUR.IP += args[0];                   \
-      if ( CUR.IP < 0 )                    \
-        CUR.error = TT_Err_Bad_Argument;   \
-      CUR.step_ins = FALSE;                \
+#define DO_JROT                                                   \
+    if ( args[1] != 0 )                                           \
+    {                                                             \
+      if ( args[0] == 0 && CUR.args == 0 )                        \
+        CUR.error = TT_Err_Bad_Argument;                          \
+      CUR.IP += args[0];                                          \
+      if ( CUR.IP < 0                                          || \
+           ( CUR.callTop > 0                                 &&   \
+             CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
+        CUR.error = TT_Err_Bad_Argument;                          \
+      CUR.step_ins = FALSE;                                       \
     }
 
 
-#define DO_JMPR                          \
-    if ( args[0] == 0 && CUR.args == 0 ) \
-      CUR.error = TT_Err_Bad_Argument;   \
-    CUR.IP += args[0];                   \
-    if ( CUR.IP < 0 )                    \
-      CUR.error = TT_Err_Bad_Argument;   \
+#define DO_JMPR                                                 \
+    if ( args[0] == 0 && CUR.args == 0 )                        \
+      CUR.error = TT_Err_Bad_Argument;                          \
+    CUR.IP += args[0];                                          \
+    if ( CUR.IP < 0                                          || \
+         ( CUR.callTop > 0                                 &&   \
+           CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
+      CUR.error = TT_Err_Bad_Argument;                          \
     CUR.step_ins = FALSE;
 
 
-#define DO_JROF                            \
-    if ( args[1] == 0 )                    \
-    {                                      \
-      if ( args[0] == 0 && CUR.args == 0 ) \
-        CUR.error = TT_Err_Bad_Argument;   \
-      CUR.IP += args[0];                   \
-      if ( CUR.IP < 0 )                    \
-        CUR.error = TT_Err_Bad_Argument;   \
-      CUR.step_ins = FALSE;                \
+#define DO_JROF                                                   \
+    if ( args[1] == 0 )                                           \
+    {                                                             \
+      if ( args[0] == 0 && CUR.args == 0 )                        \
+        CUR.error = TT_Err_Bad_Argument;                          \
+      CUR.IP += args[0];                                          \
+      if ( CUR.IP < 0                                          || \
+           ( CUR.callTop > 0                                 &&   \
+             CUR.IP > CUR.callStack[CUR.callTop - 1].Cur_End ) )  \
+        CUR.error = TT_Err_Bad_Argument;                          \
+      CUR.step_ins = FALSE;                                       \
     }
 
 
@@ -4471,7 +4477,7 @@
       CUR.length = opcode_length[CUR.opcode];
       if ( CUR.length < 0 )
       {
-        if ( CUR.IP + 1 > CUR.codeSize )
+        if ( CUR.IP + 1 >= CUR.codeSize )
           goto Fail_Overflow;
         CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
       }
@@ -4640,6 +4646,7 @@
         return;
 
       case 0x2D:   /* ENDF */
+        rec->end = CUR.IP;
         return;
       }
     }
@@ -4757,6 +4764,7 @@
     pCrec->Caller_IP    = CUR.IP + 1;
     pCrec->Cur_Count    = 1;
     pCrec->Cur_Restart  = def->start;
+    pCrec->Cur_End      = def->end;
 
     CUR.callTop++;
 
@@ -4835,6 +4843,7 @@
       pCrec->Caller_IP    = CUR.IP + 1;
       pCrec->Cur_Count    = (FT_Int)args[0];
       pCrec->Cur_Restart  = def->start;
+      pCrec->Cur_End      = def->end;
 
       CUR.callTop++;
 
@@ -5050,8 +5059,8 @@
   /* Opcode range: 0x46-0x47                                               */
   /* Stack:        uint32 --> f26.6                                        */
   /*                                                                       */
-  /* BULLSHIT: Measures from the original glyph must be taken along the    */
-  /*           dual projection vector!                                     */
+  /* XXX: UNDOCUMENTED: Measures from the original glyph must be taken     */
+  /*      along the dual projection vector!                                */
   /*                                                                       */
   static void
   Ins_GC( INS_ARG )
@@ -5123,14 +5132,14 @@
   /* Opcode range: 0x49-0x4A                                               */
   /* Stack:        uint32 uint32 --> f26.6                                 */
   /*                                                                       */
-  /* BULLSHIT: Measure taken in the original glyph must be along the dual  */
-  /*           projection vector.                                          */
+  /* XXX: UNDOCUMENTED: Measure taken in the original glyph must be along  */
+  /*                    the dual projection vector.                        */
   /*                                                                       */
-  /* Second BULLSHIT: Flag attributes are inverted!                        */
-  /*                  0 => measure distance in original outline            */
-  /*                  1 => measure distance in grid-fitted outline         */
+  /* XXX: UNDOCUMENTED: Flag attributes are inverted!                      */
+  /*                      0 => measure distance in original outline        */
+  /*                      1 => measure distance in grid-fitted outline     */
   /*                                                                       */
-  /* Third one: `zp0 - zp1', and not `zp2 - zp1!                           */
+  /* XXX: UNDOCUMENTED: `zp0 - zp1', and not `zp2 - zp1!                   */
   /*                                                                       */
   static void
   Ins_MD( INS_ARG )
@@ -5761,21 +5770,25 @@
   /* Opcode range: 0x34-35                                                 */
   /* Stack:        uint32 -->                                              */
   /*                                                                       */
+  /* UNDOCUMENTED: According to Greg Hitchcock, there is one (virtual)     */
+  /*               contour in the twilight zone, namely contour number     */
+  /*               zero.                                                   */
+  /*                                                                       */
   static void
   Ins_SHC( INS_ARG )
   {
-    TT_GlyphZoneRec zp;
-    FT_UShort       refp;
-    FT_F26Dot6      dx,
-                    dy;
+    TT_GlyphZoneRec  zp;
+    FT_UShort        refp;
+    FT_F26Dot6       dx, dy;
 
-    FT_Short        contour;
-    FT_UShort       first_point, last_point, i;
+    FT_Short         contour, bounds;
+    FT_UShort        start, limit, i;
 
 
     contour = (FT_UShort)args[0];
+    bounds  = ( CUR.GS.gep2 == 0 ) ? 1 : CUR.zp2.n_contours;
 
-    if ( BOUNDS( contour, CUR.pts.n_contours ) )
+    if ( BOUNDS( contour, bounds ) )
     {
       if ( CUR.pedantic_hinting )
         CUR.error = TT_Err_Invalid_Reference;
@@ -5786,25 +5799,19 @@
       return;
 
     if ( contour == 0 )
-      first_point = 0;
+      start = 0;
     else
-      first_point = (FT_UShort)( CUR.pts.contours[contour - 1] + 1 -
-                                 CUR.pts.first_point );
+      start = (FT_UShort)( CUR.zp2.contours[contour - 1] + 1 -
+                           CUR.zp2.first_point );
 
-    last_point = (FT_UShort)( CUR.pts.contours[contour] -
-                              CUR.pts.first_point );
-
-    /* XXX: this is probably wrong... at least it prevents memory */
-    /*      corruption when zp2 is the twilight zone              */
-    if ( BOUNDS( last_point, CUR.zp2.n_points ) )
-    {
-      if ( CUR.zp2.n_points > 0 )
-        last_point = (FT_UShort)(CUR.zp2.n_points - 1);
-      else
-        last_point = 0;
-    }
+    /* we use the number of points if in the twilight zone */
+    if ( CUR.GS.gep2 == 0 )
+      limit = CUR.zp2.n_points;
+    else
+      limit = (FT_UShort)( CUR.zp2.contours[contour] -
+                           CUR.zp2.first_point + 1 );
 
-    for ( i = first_point; i <= last_point; i++ )
+    for ( i = start; i < limit; i++ )
     {
       if ( zp.cur != CUR.zp2.cur || refp != i )
         MOVE_Zp2_Point( i, dx, dy, TRUE );
@@ -5826,7 +5833,7 @@
     FT_F26Dot6       dx,
                      dy;
 
-    FT_UShort        last_point, i;
+    FT_UShort        limit, i;
 
 
     if ( BOUNDS( args[0], 2 ) )
@@ -5839,28 +5846,19 @@
     if ( COMPUTE_Point_Displacement( &dx, &dy, &zp, &refp ) )
       return;
 
-    /* XXX: UNDOCUMENTED! SHZ doesn't move the phantom points.  */
-    /*      Twilight zone has no contours, so use `n_points'.   */
-    /*      Normal zone's `n_points' includes phantoms, so must */
-    /*      use end of last contour.                            */
-    if ( CUR.GS.gep2 == 0 && CUR.zp2.n_points > 0 )
-      last_point = (FT_UShort)( CUR.zp2.n_points - 1 );
+    /* XXX: UNDOCUMENTED! SHZ doesn't move the phantom points.     */
+    /*      Twilight zone has no real contours, so use `n_points'. */
+    /*      Normal zone's `n_points' includes phantoms, so must    */
+    /*      use end of last contour.                               */
+    if ( CUR.GS.gep2 == 0 )
+      limit = (FT_UShort)CUR.zp2.n_points;
     else if ( CUR.GS.gep2 == 1 && CUR.zp2.n_contours > 0 )
-    {
-      last_point = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] );
-
-      if ( BOUNDS( last_point, CUR.zp2.n_points ) )
-      {
-        if ( CUR.pedantic_hinting )
-          CUR.error = TT_Err_Invalid_Reference;
-        return;
-      }
-    }
+      limit = (FT_UShort)( CUR.zp2.contours[CUR.zp2.n_contours - 1] + 1 );
     else
-      last_point = 0;
+      limit = 0;
 
     /* XXX: UNDOCUMENTED! SHZ doesn't touch the points */
-    for ( i = 0; i <= last_point; i++ )
+    for ( i = 0; i < limit; i++ )
     {
       if ( zp.cur != CUR.zp2.cur || refp != i )
         MOVE_Zp2_Point( i, dx, dy, FALSE );
@@ -6266,7 +6264,7 @@
       CUR.zp1.org[point].y = CUR.zp0.org[CUR.GS.rp0].y +
                              TT_MulFix14( (FT_UInt32)cvt_dist,
                                           CUR.GS.freeVector.y );
-      CUR.zp1.cur[point]   = CUR.zp0.cur[point];
+      CUR.zp1.cur[point]   = CUR.zp1.org[point];
     }
 
     org_dist = CUR_Func_dualproj( &CUR.zp1.org[point],
@@ -6575,9 +6573,21 @@
       if ( twilight )
         old_range = CUR_Func_dualproj( &CUR.zp1.org[CUR.GS.rp2],
                                        orus_base );
-      else
+      else if ( CUR.metrics.x_scale == CUR.metrics.y_scale )
         old_range = CUR_Func_dualproj( &CUR.zp1.orus[CUR.GS.rp2],
                                        orus_base );
+      else
+      {
+        FT_Vector  vec;
+
+
+        vec.x = TT_MULFIX( CUR.zp1.orus[CUR.GS.rp2].x - orus_base->x,
+                           CUR.metrics.x_scale );
+        vec.y = TT_MULFIX( CUR.zp1.orus[CUR.GS.rp2].y - orus_base->y,
+                           CUR.metrics.y_scale );
+
+        old_range = CUR_fast_dualproj( &vec );
+      }
 
       cur_range = CUR_Func_project ( &CUR.zp1.cur[CUR.GS.rp2], cur_base );
     }
@@ -6601,8 +6611,20 @@
 
       if ( twilight )
         org_dist = CUR_Func_dualproj( &CUR.zp2.org[point], orus_base );
-      else
+      else if ( CUR.metrics.x_scale == CUR.metrics.y_scale )
         org_dist = CUR_Func_dualproj( &CUR.zp2.orus[point], orus_base );
+      else
+      {
+        FT_Vector  vec;
+
+
+        vec.x = TT_MULFIX( CUR.zp2.orus[point].x - orus_base->x,
+                           CUR.metrics.x_scale );
+        vec.y = TT_MULFIX( CUR.zp2.orus[point].y - orus_base->y,
+                           CUR.metrics.y_scale );
+
+        org_dist = CUR_fast_dualproj( &vec );
+      }
 
       cur_dist = CUR_Func_project ( &CUR.zp2.cur[point], cur_base );
 
@@ -7149,6 +7171,7 @@
         call->Caller_IP    = CUR.IP + 1;
         call->Cur_Count    = 1;
         call->Cur_Restart  = def->start;
+        call->Cur_End      = def->end;
 
         INS_Goto_CodeRange( def->range, def->start );
 
@@ -7521,7 +7544,7 @@
 
       if ( ( CUR.length = opcode_length[CUR.opcode] ) < 0 )
       {
-        if ( CUR.IP + 1 > CUR.codeSize )
+        if ( CUR.IP + 1 >= CUR.codeSize )
           goto LErrorCodeOverflow_;
 
         CUR.length = 2 - CUR.length * CUR.code[CUR.IP + 1];
@@ -8157,6 +8180,7 @@
                 callrec->Caller_IP    = CUR.IP + 1;
                 callrec->Cur_Count    = 1;
                 callrec->Cur_Restart  = def->start;
+                callrec->Cur_End      = def->end;
 
                 if ( INS_Goto_CodeRange( def->range, def->start ) == FAILURE )
                   goto LErrorLabel_;
@@ -8230,7 +8254,7 @@
     if ( CUR.error && !CUR.instruction_trap )
     {
       FT_TRACE1(( "  The interpreter returned error 0x%x\n", CUR.error ));
-      exc->size->cvt_ready      = FALSE;  
+      exc->size->cvt_ready      = FALSE;
     }
 
     return CUR.error;
diff --git a/src/truetype/ttinterp.h b/src/truetype/ttinterp.h
index c480dfa..6d0fc03 100644
--- a/src/truetype/ttinterp.h
+++ b/src/truetype/ttinterp.h
@@ -102,6 +102,7 @@ FT_BEGIN_HEADER
     FT_Long  Caller_IP;
     FT_Long  Cur_Count;
     FT_Long  Cur_Restart;
+    FT_Long  Cur_End;
 
   } TT_CallRec, *TT_CallStack;
 
diff --git a/src/truetype/ttobjs.c b/src/truetype/ttobjs.c
index d77c3c4..814c713 100644
--- a/src/truetype/ttobjs.c
+++ b/src/truetype/ttobjs.c
@@ -328,7 +328,7 @@
 
 
     FT_MEM_SET( num_matched_ids, 0,
-                sizeof( int ) * TRICK_SFNT_IDS_NUM_FACES );
+                sizeof ( int ) * TRICK_SFNT_IDS_NUM_FACES );
     has_cvt  = FALSE;
     has_fpgm = FALSE;
     has_prep = FALSE;
@@ -493,10 +493,17 @@
     TT_Face       face = (TT_Face)ttface;
 
 
+    FT_TRACE2(( "TTF driver\n" ));
+
     library = ttface->driver->root.library;
-    sfnt    = (SFNT_Service)FT_Get_Module_Interface( library, "sfnt" );
+
+    sfnt = (SFNT_Service)FT_Get_Module_Interface( library, "sfnt" );
     if ( !sfnt )
-      goto Bad_Format;
+    {
+      FT_ERROR(( "tt_face_init: cannot access `sfnt' module\n" ));
+      error = TT_Err_Missing_Module;
+      goto Exit;
+    }
 
     /* create input stream from resource */
     if ( FT_STREAM_SEEK( 0 ) )
@@ -514,7 +521,7 @@
          face->format_tag != 0x00020000L &&    /* CJK fonts for Win 3.1 */
          face->format_tag != TTAG_true   )     /* Mac fonts */
     {
-      FT_TRACE2(( "[not a valid TTF font]\n" ));
+      FT_TRACE2(( "  not a TTF font\n" ));
       goto Bad_Format;
     }
 
diff --git a/src/truetype/ttobjs.h b/src/truetype/ttobjs.h
index 087b3c2..47e4129 100644
--- a/src/truetype/ttobjs.h
+++ b/src/truetype/ttobjs.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Objects manager (specification).                                     */
 /*                                                                         */
-/*  Copyright 1996-2009, 2011 by                                           */
+/*  Copyright 1996-2009, 2011-2012 by                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -175,6 +175,7 @@ FT_BEGIN_HEADER
   {
     FT_Int   range;      /* in which code range is it located? */
     FT_Long  start;      /* where does it start?               */
+    FT_Long  end;        /* where does it end?                 */
     FT_UInt  opc;        /* function #, or instruction code    */
     FT_Bool  active;     /* is it active?                      */
 
diff --git a/src/truetype/ttpic.c b/src/truetype/ttpic.c
index 5d72574..65ca845 100644
--- a/src/truetype/ttpic.c
+++ b/src/truetype/ttpic.c
@@ -20,25 +20,41 @@
 #include FT_FREETYPE_H
 #include FT_INTERNAL_OBJECTS_H
 #include "ttpic.h"
+#include "tterrors.h"
 
 #ifdef FT_CONFIG_OPTION_PIC
 
   /* forward declaration of PIC init functions from ttdriver.c */
-  FT_Error FT_Create_Class_tt_services( FT_Library, FT_ServiceDescRec**);
-  void FT_Destroy_Class_tt_services( FT_Library, FT_ServiceDescRec*);
-  void FT_Init_Class_tt_service_gx_multi_masters(FT_Service_MultiMastersRec*);
-  void FT_Init_Class_tt_service_truetype_glyf(FT_Service_TTGlyfRec*);
+  FT_Error
+  FT_Create_Class_tt_services( FT_Library           library,
+                               FT_ServiceDescRec**  output_class );
+
+  void
+  FT_Destroy_Class_tt_services( FT_Library          library,
+                                FT_ServiceDescRec*  clazz );
+
+  void
+  FT_Init_Class_tt_service_gx_multi_masters(
+    FT_Service_MultiMastersRec*  sv_mm );
+
+  void
+  FT_Init_Class_tt_service_truetype_glyf(
+    FT_Service_TTGlyfRec*  sv_ttglyf );
 
   void
-  tt_driver_class_pic_free(  FT_Library library )
+  tt_driver_class_pic_free( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
-    FT_Memory memory = library->memory;
+    FT_PIC_Container*  pic_container = &library->pic_container;
+    FT_Memory  memory = library->memory;
+
+
     if ( pic_container->truetype )
     {
-      TTModulePIC* container = (TTModulePIC*)pic_container->truetype;
-      if(container->tt_services)
-        FT_Destroy_Class_tt_services(library, container->tt_services);
+      TTModulePIC*  container = (TTModulePIC*)pic_container->truetype;
+
+
+      if ( container->tt_services )
+        FT_Destroy_Class_tt_services( library, container->tt_services );
       container->tt_services = NULL;
       FT_FREE( container );
       pic_container->truetype = NULL;
@@ -58,20 +74,23 @@
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->truetype = container;
 
     /* initialize pointer table - this is how the module usually expects this data */
-    error = FT_Create_Class_tt_services(library, &container->tt_services);
-    if(error) 
+    error = FT_Create_Class_tt_services( library,
+                                         &container->tt_services );
+    if ( error )
       goto Exit;
 #ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
-    FT_Init_Class_tt_service_gx_multi_masters(&container->tt_service_gx_multi_masters);
+    FT_Init_Class_tt_service_gx_multi_masters(
+      &container->tt_service_gx_multi_masters );
 #endif
-    FT_Init_Class_tt_service_truetype_glyf(&container->tt_service_truetype_glyf);
+    FT_Init_Class_tt_service_truetype_glyf(
+      &container->tt_service_truetype_glyf );
 Exit:
-    if(error)
-      tt_driver_class_pic_free(library);
+    if ( error )
+      tt_driver_class_pic_free( library );
     return error;
   }
 
diff --git a/src/truetype/ttpic.h b/src/truetype/ttpic.h
index 84de0fe..48f43a5 100644
--- a/src/truetype/ttpic.h
+++ b/src/truetype/ttpic.h
@@ -19,7 +19,7 @@
 #ifndef __TTPIC_H__
 #define __TTPIC_H__
 
-  
+
 FT_BEGIN_HEADER
 
 #ifndef FT_CONFIG_OPTION_PIC
@@ -47,6 +47,13 @@ FT_BEGIN_HEADER
 #define FT_TT_SERVICE_GX_MULTI_MASTERS_GET   (GET_PIC(library)->tt_service_gx_multi_masters)
 #define FT_TT_SERVICE_TRUETYPE_GLYF_GET      (GET_PIC(library)->tt_service_truetype_glyf)
 
+  /* see ttpic.c for the implementation */
+  void
+  tt_driver_class_pic_free( FT_Library  library );
+
+  FT_Error
+  tt_driver_class_pic_init( FT_Library  library );
+
 #endif /* FT_CONFIG_OPTION_PIC */
 
  /* */
diff --git a/src/truetype/ttpload.c b/src/truetype/ttpload.c
index 818b29d..bb6005d 100644
--- a/src/truetype/ttpload.c
+++ b/src/truetype/ttpload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType-specific tables loader (body).                              */
 /*                                                                         */
-/*  Copyright 1996-2002, 2004-2011 by                                      */
+/*  Copyright 1996-2002, 2004-2012 by                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -211,22 +211,22 @@
     }
 
     /* Check broken location data */
-    if ( pos1 >= face->glyf_len )
+    if ( pos1 > face->glyf_len )
     {
       FT_TRACE1(( "tt_face_get_location:"
-                 " too large offset=0x%08lx found for gid=0x%04lx,"
-                 " exceeding the end of glyf table (0x%08lx)\n",
-                 pos1, gindex, face->glyf_len ));
+                  " too large offset=0x%08lx found for gid=0x%04lx,"
+                  " exceeding the end of glyf table (0x%08lx)\n",
+                  pos1, gindex, face->glyf_len ));
       *asize = 0;
       return 0;
     }
 
-    if ( pos2 >= face->glyf_len )
+    if ( pos2 > face->glyf_len )
     {
       FT_TRACE1(( "tt_face_get_location:"
-                 " too large offset=0x%08lx found for gid=0x%04lx,"
-                 " truncate at the end of glyf table (0x%08lx)\n",
-                 pos2, gindex + 1, face->glyf_len ));
+                  " too large offset=0x%08lx found for gid=0x%04lx,"
+                  " truncate at the end of glyf table (0x%08lx)\n",
+                  pos2, gindex + 1, face->glyf_len ));
       pos2 = face->glyf_len;
     }