diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2022-04-05 01:58:38 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2022-04-05 01:58:38 +0000 |
commit | 5bff9ca8e2b241daefc929d1d93a36b96c570e94 (patch) | |
tree | ede68b76c2074b0a8308d8b7a8c65abb9bde3ffb /Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c | |
parent | f8c9fa0f3e341f99f49f318029b143b560531817 (diff) |
freetype 2.12.0
git-svn-id: svn://tug.org/texlive/trunk@62910 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c')
-rw-r--r-- | Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c | 63 |
1 files changed, 41 insertions, 22 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c b/Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c index ea2c5198a9d..f14b4226c7a 100644 --- a/Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c +++ b/Build/source/libs/freetype2/freetype-src/src/type42/t42parse.c @@ -4,7 +4,7 @@ * * Type 42 font parser (body). * - * Copyright (C) 2002-2021 by + * Copyright (C) 2002-2022 by * Roberto Alameda. * * This file is part of the FreeType project, and may only be used, @@ -363,8 +363,8 @@ /* we use a T1_Table to store our charnames */ loader->num_chars = encode->num_chars = count; - if ( FT_NEW_ARRAY( encode->char_index, count ) || - FT_NEW_ARRAY( encode->char_name, count ) || + if ( FT_QNEW_ARRAY( encode->char_index, count ) || + FT_QNEW_ARRAY( encode->char_name, count ) || FT_SET_ERROR( psaux->ps_table_funcs->init( char_table, count, memory ) ) ) { @@ -538,7 +538,8 @@ FT_Byte* limit = parser->root.limit; FT_Error error; FT_Int num_tables = 0; - FT_Long count; + FT_Long ttf_count; + FT_Long ttf_reserved; FT_ULong n, string_size, old_string_size, real_size; FT_Byte* string_buf = NULL; @@ -546,6 +547,9 @@ T42_Load_Status status; + /** There should only be one sfnts array, but free any previous. */ + FT_FREE( face->ttf_data ); + face->ttf_size = 0; /* The format is */ /* */ @@ -574,7 +578,10 @@ status = BEFORE_START; string_size = 0; old_string_size = 0; - count = 0; + ttf_count = 0; + ttf_reserved = 12; + if ( FT_QALLOC( face->ttf_data, ttf_reserved ) ) + goto Fail; FT_TRACE2(( "\n" )); FT_TRACE2(( "t42_parse_sfnts:\n" )); @@ -589,6 +596,7 @@ if ( *cur == ']' ) { parser->root.cursor++; + face->ttf_size = ttf_count; goto Exit; } @@ -684,7 +692,7 @@ } FT_TRACE2(( " PS string size %5lu bytes, offset 0x%08lx (%lu)\n", - string_size, count, count )); + string_size, ttf_count, ttf_count )); /* The whole TTF is now loaded into `string_buf'. We are */ /* checking its contents while copying it to `ttf_data'. */ @@ -697,43 +705,48 @@ { case BEFORE_START: /* load offset table, 12 bytes */ - if ( count < 12 ) + if ( ttf_count < 12 ) { - face->ttf_data[count++] = string_buf[n]; + face->ttf_data[ttf_count++] = string_buf[n]; continue; } else { - num_tables = 16 * face->ttf_data[4] + face->ttf_data[5]; - status = BEFORE_TABLE_DIR; - face->ttf_size = 12 + 16 * num_tables; + FT_Long ttf_reserved_prev = ttf_reserved; + + + num_tables = 16 * face->ttf_data[4] + face->ttf_data[5]; + status = BEFORE_TABLE_DIR; + ttf_reserved = 12 + 16 * num_tables; FT_TRACE2(( " SFNT directory contains %d tables\n", num_tables )); - if ( (FT_Long)size < face->ttf_size ) + if ( (FT_Long)size < ttf_reserved ) { FT_ERROR(( "t42_parse_sfnts: invalid data in sfnts array\n" )); error = FT_THROW( Invalid_File_Format ); goto Fail; } - if ( FT_QREALLOC( face->ttf_data, 12, face->ttf_size ) ) + if ( FT_QREALLOC( face->ttf_data, ttf_reserved_prev, + ttf_reserved ) ) goto Fail; } /* fall through */ case BEFORE_TABLE_DIR: /* the offset table is read; read the table directory */ - if ( count < face->ttf_size ) + if ( ttf_count < ttf_reserved ) { - face->ttf_data[count++] = string_buf[n]; + face->ttf_data[ttf_count++] = string_buf[n]; continue; } else { int i; FT_ULong len; + FT_Long ttf_reserved_prev = ttf_reserved; FT_TRACE2(( "\n" )); @@ -749,7 +762,7 @@ FT_TRACE2(( " %4i 0x%08lx (%lu)\n", i, len, len )); if ( len > size || - face->ttf_size > (FT_Long)( size - len ) ) + ttf_reserved > (FT_Long)( size - len ) ) { FT_ERROR(( "t42_parse_sfnts:" " invalid data in sfnts array\n" )); @@ -758,30 +771,31 @@ } /* Pad to a 4-byte boundary length */ - face->ttf_size += (FT_Long)( ( len + 3 ) & ~3U ); + ttf_reserved += (FT_Long)( ( len + 3 ) & ~3U ); } + ttf_reserved += 1; status = OTHER_TABLES; FT_TRACE2(( "\n" )); - FT_TRACE2(( " allocating %ld bytes\n", face->ttf_size + 1 )); + FT_TRACE2(( " allocating %ld bytes\n", ttf_reserved )); FT_TRACE2(( "\n" )); - if ( FT_QREALLOC( face->ttf_data, 12 + 16 * num_tables, - face->ttf_size + 1 ) ) + if ( FT_QREALLOC( face->ttf_data, ttf_reserved_prev, + ttf_reserved ) ) goto Fail; } /* fall through */ case OTHER_TABLES: /* all other tables are just copied */ - if ( count >= face->ttf_size ) + if ( ttf_count >= ttf_reserved ) { FT_ERROR(( "t42_parse_sfnts: too much binary data\n" )); error = FT_THROW( Invalid_File_Format ); goto Fail; } - face->ttf_data[count++] = string_buf[n]; + face->ttf_data[ttf_count++] = string_buf[n]; } } @@ -795,6 +809,11 @@ parser->root.error = error; Exit: + if ( parser->root.error ) + { + FT_FREE( face->ttf_data ); + face->ttf_size = 0; + } if ( allocated ) FT_FREE( string_buf ); } |