diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2021-08-29 06:19:44 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2021-08-29 06:19:44 +0000 |
commit | 0de5be92a3a0fe27e8521fc4de67e19b1057842e (patch) | |
tree | e93a390fe965486cca19498840cb8d7904252fec /Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c | |
parent | 27ce96eea3f1190bd744448cfa149e8d767af95a (diff) |
revert freetype to 2.10.4
git-svn-id: svn://tug.org/texlive/trunk@60360 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c')
-rw-r--r-- | Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c | 111 |
1 files changed, 61 insertions, 50 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c index b92ca5db149..e93a4bf1b16 100644 --- a/Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c +++ b/Build/source/libs/freetype2/freetype-src/src/sfnt/ttpost.c @@ -5,7 +5,7 @@ * PostScript name table processing for TrueType and OpenType fonts * (body). * - * Copyright (C) 1996-2021 by + * Copyright (C) 1996-2020 by * David Turner, Robert Wilhelm, and Werner Lemberg. * * This file is part of the FreeType project, and may only be used, @@ -158,7 +158,7 @@ static FT_Error load_format_20( TT_Face face, FT_Stream stream, - FT_ULong post_len ) + FT_ULong post_limit ) { FT_Memory memory = stream->memory; FT_Error error; @@ -168,7 +168,6 @@ FT_UShort* glyph_indices = NULL; FT_Char** name_strings = NULL; - FT_Byte* strings = NULL; if ( FT_READ_USHORT( num_glyphs ) ) @@ -180,8 +179,7 @@ /* There already exist fonts which have more than 32768 glyph names */ /* in this table, so the test for this threshold has been dropped. */ - if ( num_glyphs > face->max_profile.numGlyphs || - (FT_ULong)num_glyphs * 2UL > post_len - 2 ) + if ( num_glyphs > face->max_profile.numGlyphs ) { error = FT_THROW( Invalid_File_Format ); goto Exit; @@ -192,7 +190,7 @@ FT_Int n; - if ( FT_QNEW_ARRAY( glyph_indices, num_glyphs ) || + if ( FT_NEW_ARRAY ( glyph_indices, num_glyphs ) || FT_FRAME_ENTER( num_glyphs * 2L ) ) goto Fail; @@ -225,56 +223,60 @@ } /* now load the name strings */ - if ( num_names ) { FT_UShort n; - FT_ULong p; - post_len -= (FT_ULong)num_glyphs * 2UL + 2; - - if ( FT_QALLOC( strings, post_len + 1 ) || - FT_STREAM_READ( strings, post_len ) || - FT_QNEW_ARRAY( name_strings, num_names ) ) + if ( FT_NEW_ARRAY( name_strings, num_names ) ) goto Fail; - /* convert from Pascal- to C-strings and set pointers */ - for ( p = 0, n = 0; p < post_len && n < num_names; n++ ) + for ( n = 0; n < num_names; n++ ) { - FT_UInt len = strings[p]; + FT_UInt len; - if ( len > 63U ) + if ( FT_STREAM_POS() >= post_limit ) + break; + else { - error = FT_THROW( Invalid_File_Format ); - goto Fail; - } + FT_TRACE6(( "load_format_20: %ld byte left in post table\n", + post_limit - FT_STREAM_POS() )); - strings[p] = 0; - name_strings[n] = (FT_Char*)strings + p + 1; - p += len + 1; - } - strings[post_len] = 0; + if ( FT_READ_BYTE( len ) ) + goto Fail1; + } - /* deal with missing or insufficient string data */ - if ( n < num_names ) - { - if ( post_len == 0 ) + if ( len > post_limit || + FT_STREAM_POS() > post_limit - len ) { - /* fake empty string */ - if ( FT_QREALLOC( strings, 1, 2 ) ) - goto Fail; + FT_Int d = (FT_Int)post_limit - (FT_Int)FT_STREAM_POS(); + - post_len = 1; - strings[post_len] = 0; + FT_ERROR(( "load_format_20:" + " exceeding string length (%d)," + " truncating at end of post table (%d byte left)\n", + len, d )); + len = (FT_UInt)FT_MAX( 0, d ); } + if ( FT_NEW_ARRAY( name_strings[n], len + 1 ) || + FT_STREAM_READ( name_strings[n], len ) ) + goto Fail1; + + name_strings[n][len] = '\0'; + } + + if ( n < num_names ) + { FT_ERROR(( "load_format_20:" " all entries in post table are already parsed," " using NULL names for gid %d - %d\n", n, num_names - 1 )); for ( ; n < num_names; n++ ) - name_strings[n] = (FT_Char*)strings + post_len; + if ( FT_NEW_ARRAY( name_strings[n], 1 ) ) + goto Fail1; + else + name_strings[n][0] = '\0'; } } @@ -290,9 +292,17 @@ } return FT_Err_Ok; + Fail1: + { + FT_UShort n; + + + for ( n = 0; n < num_names; n++ ) + FT_FREE( name_strings[n] ); + } + Fail: FT_FREE( name_strings ); - FT_FREE( strings ); FT_FREE( glyph_indices ); Exit: @@ -303,7 +313,7 @@ static FT_Error load_format_25( TT_Face face, FT_Stream stream, - FT_ULong post_len ) + FT_ULong post_limit ) { FT_Memory memory = stream->memory; FT_Error error; @@ -311,7 +321,7 @@ FT_Int num_glyphs; FT_Char* offset_table = NULL; - FT_UNUSED( post_len ); + FT_UNUSED( post_limit ); if ( FT_READ_USHORT( num_glyphs ) ) @@ -326,7 +336,7 @@ goto Exit; } - if ( FT_QNEW_ARRAY( offset_table, num_glyphs ) || + if ( FT_NEW_ARRAY( offset_table, num_glyphs ) || FT_STREAM_READ( offset_table, num_glyphs ) ) goto Fail; @@ -374,6 +384,7 @@ FT_Error error; FT_Fixed format; FT_ULong post_len; + FT_ULong post_limit; /* get a stream for the face's resource */ @@ -384,6 +395,8 @@ if ( error ) goto Exit; + post_limit = FT_STREAM_POS() + post_len; + format = face->postscript.FormatType; /* go to beginning of subtable */ @@ -391,10 +404,10 @@ goto Exit; /* now read postscript table */ - if ( format == 0x00020000L && post_len >= 34 ) - error = load_format_20( face, stream, post_len - 32 ); - else if ( format == 0x00025000L && post_len >= 34 ) - error = load_format_25( face, stream, post_len - 32 ); + if ( format == 0x00020000L ) + error = load_format_20( face, stream, post_limit ); + else if ( format == 0x00025000L ) + error = load_format_25( face, stream, post_limit ); else error = FT_THROW( Invalid_File_Format ); @@ -420,19 +433,17 @@ if ( format == 0x00020000L ) { TT_Post_20 table = &names->names.format_20; + FT_UShort n; FT_FREE( table->glyph_indices ); table->num_glyphs = 0; - if ( table->num_names ) - { - table->glyph_names[0]--; - FT_FREE( table->glyph_names[0] ); + for ( n = 0; n < table->num_names; n++ ) + FT_FREE( table->glyph_names[n] ); - FT_FREE( table->glyph_names ); - table->num_names = 0; - } + FT_FREE( table->glyph_names ); + table->num_names = 0; } else if ( format == 0x00025000L ) { |