From 77f63d23f7d380b0ff02c18fd6a154ab9063128a Mon Sep 17 00:00:00 2001 From: David 'Digit' Turner Date: Mon, 8 Jun 2009 15:18:21 +0200 Subject: Integrate FreeType 2.3.9 into the donut tree. This is done to get fixes for a few security-related issues. NOTE: the auto-hinter hasn't been changed to avoid modifying the rendering of characters. The 2.3.9 code contains minor fixes (not security-related) that could in theory do that (though extensive testing is needed to evaluate its real impact on Android). --- src/psaux/psobjs.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) (limited to 'src/psaux/psobjs.c') diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c index b7b84ac..52e30a4 100644 --- a/src/psaux/psobjs.c +++ b/src/psaux/psobjs.c @@ -4,7 +4,7 @@ /* */ /* Auxiliary functions for PostScript fonts (body). */ /* */ -/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 by */ +/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */ /* David Turner, Robert Wilhelm, and Werner Lemberg. */ /* */ /* This file is part of the FreeType project, and may only be used, */ @@ -175,11 +175,17 @@ return PSaux_Err_Invalid_Argument; } + if ( length < 0 ) + { + FT_ERROR(( "ps_table_add: invalid length\n" )); + return PSaux_Err_Invalid_Argument; + } + /* grow the base block if needed */ if ( table->cursor + length > table->capacity ) { FT_Error error; - FT_Offset new_size = table->capacity; + FT_Offset new_size = table->capacity; FT_Long in_offset; @@ -376,7 +382,7 @@ /* skip octal escape or ignore backslash */ for ( i = 0; i < 3 && cur < limit; ++i ) { - if ( ! IS_OCTAL_DIGIT( *cur ) ) + if ( !IS_OCTAL_DIGIT( *cur ) ) break; ++cur; @@ -1259,8 +1265,9 @@ old_cursor = parser->cursor; old_limit = parser->limit; - /* we store the elements count if necessary */ - if ( field->type != T1_FIELD_TYPE_BBOX ) + /* we store the elements count if necessary; */ + /* we further assume that `count_offset' can't be zero */ + if ( field->type != T1_FIELD_TYPE_BBOX && field->count_offset != 0 ) *(FT_Byte*)( (FT_Byte*)objects[0] + field->count_offset ) = (FT_Byte)num_elements; @@ -1634,27 +1641,24 @@ t1_builder_close_contour( T1_Builder builder ) { FT_Outline* outline = builder->current; + FT_Int first; if ( !outline ) return; - /* XXXX: We must not include the last point in the path if it */ - /* is located on the first point. */ + first = outline->n_contours <= 1 + ? 0 : outline->contours[outline->n_contours - 2] + 1; + + /* We must not include the last point in the path if it */ + /* is located on the first point. */ if ( outline->n_points > 1 ) { - FT_Int first = 0; FT_Vector* p1 = outline->points + first; FT_Vector* p2 = outline->points + outline->n_points - 1; FT_Byte* control = (FT_Byte*)outline->tags + outline->n_points - 1; - if ( outline->n_contours > 1 ) - { - first = outline->contours[outline->n_contours - 2] + 1; - p1 = outline->points + first; - } - /* `delete' last point only if it coincides with the first */ /* point and it is not a control point (which can happen). */ if ( p1->x == p2->x && p1->y == p2->y ) @@ -1663,8 +1667,18 @@ } if ( outline->n_contours > 0 ) - outline->contours[outline->n_contours - 1] = - (short)( outline->n_points - 1 ); + { + /* Don't add contours only consisting of one point, i.e., */ + /* check whether begin point and last point are the same. */ + if ( first == outline->n_points - 1 ) + { + outline->n_contours--; + outline->n_points--; + } + else + outline->contours[outline->n_contours - 1] = + (short)( outline->n_points - 1 ); + } } -- cgit v1.2.3