graphite2 1.3.6

git-svn-id: svn://tug.org/texlive/trunk@39898 c570f23f-e606-0410-a88d-b1316a301751

24 files changed, 116 insertions, 68 deletions

diff --git a/Build/source/libs/README b/Build/source/libs/README
index 540dc3f561d..2287aaccfdd 100644
--- a/Build/source/libs/README
+++ b/Build/source/libs/README
@@ -21,7 +21,7 @@ gd 2.1.1 - checked 14jan15
 gmp 6.1.0 - checked 28dec15
   http://ftp.gnu.org/gnu/gmp/
 
-graphite2 1.3.5 - checked 20jan16
+graphite2 1.3.6 - checked 01mar16
   http://sourceforge.net/projects/silgraphite/files/graphite2/
 
 harfbuzz 1.2.3 - checked 25feb16
diff --git a/Build/source/libs/graphite2/ChangeLog b/Build/source/libs/graphite2/ChangeLog
index 7b4f7aa594b..b6790892f5b 100644
--- a/Build/source/libs/graphite2/ChangeLog
+++ b/Build/source/libs/graphite2/ChangeLog
@@ -1,3 +1,8 @@
+2016-03-01  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+
+	Import graphite2-1.3.6.
+	* version.ac: Adjusted.
+
 2016-02-15  Karl Berry  <karl@tug.org>
 
 	* graphite2-PATCHES: rename from graphite2-src-PATCHES.
diff --git a/Build/source/libs/graphite2/configure b/Build/source/libs/graphite2/configure
index 007b001d54a..4a2c29c0268 100755
--- a/Build/source/libs/graphite2/configure
+++ b/Build/source/libs/graphite2/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for graphite2 (TeX Live) 1.3.5.
+# Generated by GNU Autoconf 2.69 for graphite2 (TeX Live) 1.3.6.
 #
 # Report bugs to <tex-k@tug.org>.
 #
@@ -579,8 +579,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='graphite2 (TeX Live)'
 PACKAGE_TARNAME='graphite2--tex-live-'
-PACKAGE_VERSION='1.3.5'
-PACKAGE_STRING='graphite2 (TeX Live) 1.3.5'
+PACKAGE_VERSION='1.3.6'
+PACKAGE_STRING='graphite2 (TeX Live) 1.3.6'
 PACKAGE_BUGREPORT='tex-k@tug.org'
 PACKAGE_URL=''
 
@@ -1254,7 +1254,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures graphite2 (TeX Live) 1.3.5 to adapt to many kinds of systems.
+\`configure' configures graphite2 (TeX Live) 1.3.6 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1321,7 +1321,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of graphite2 (TeX Live) 1.3.5:";;
+     short | recursive ) echo "Configuration of graphite2 (TeX Live) 1.3.6:";;
    esac
   cat <<\_ACEOF
 
@@ -1419,7 +1419,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-graphite2 (TeX Live) configure 1.3.5
+graphite2 (TeX Live) configure 1.3.6
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1558,7 +1558,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by graphite2 (TeX Live) $as_me 1.3.5, which was
+It was created by graphite2 (TeX Live) $as_me 1.3.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3481,7 +3481,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='graphite2--tex-live-'
- VERSION='1.3.5'
+ VERSION='1.3.6'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -5577,7 +5577,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by graphite2 (TeX Live) $as_me 1.3.5, which was
+This file was extended by graphite2 (TeX Live) $as_me 1.3.6, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -5643,7 +5643,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-graphite2 (TeX Live) config.status 1.3.5
+graphite2 (TeX Live) config.status 1.3.6
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
diff --git a/Build/source/libs/graphite2/graphite2-PATCHES/ChangeLog b/Build/source/libs/graphite2/graphite2-PATCHES/ChangeLog
index a50f2b72941..baa126ff8e2 100644
--- a/Build/source/libs/graphite2/graphite2-PATCHES/ChangeLog
+++ b/Build/source/libs/graphite2/graphite2-PATCHES/ChangeLog
@@ -1,3 +1,8 @@
+2016-03-01  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
+
+	Imported graphite2-1.3.6 source tree from:
+	  http://sourceforge.net/projects/silgraphite/files/graphite2/
+
 2016-01-20  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
 
 	Imported graphite2-1.3.5 source tree from:
diff --git a/Build/source/libs/graphite2/graphite2-PATCHES/TL-Changes b/Build/source/libs/graphite2/graphite2-PATCHES/TL-Changes
index 56d22845393..08fa835e4f2 100644
--- a/Build/source/libs/graphite2/graphite2-PATCHES/TL-Changes
+++ b/Build/source/libs/graphite2/graphite2-PATCHES/TL-Changes
@@ -1,4 +1,4 @@
-Changes applied to the graphite2-1.3.5/ tree as obtained from:
+Changes applied to the graphite2-1.3.6/ tree as obtained from:
 	http://sourceforge.net/projects/silgraphite/files/graphite2/
 
 Removed unused dirs:
diff --git a/Build/source/libs/graphite2/graphite2-src/ChangeLog b/Build/source/libs/graphite2/graphite2-src/ChangeLog
index 40f8fd4a7ef..522b8101175 100644
--- a/Build/source/libs/graphite2/graphite2-src/ChangeLog
+++ b/Build/source/libs/graphite2/graphite2-src/ChangeLog
@@ -1,3 +1,6 @@
+1.3.6
+    . Bug fixes
+
 1.3.5
     . Bug fixes
         . Security bug fix
diff --git a/Build/source/libs/graphite2/graphite2-src/include/graphite2/Font.h b/Build/source/libs/graphite2/graphite2-src/include/graphite2/Font.h
index 8c96ec3cc7b..30b89994e74 100644
--- a/Build/source/libs/graphite2/graphite2-src/include/graphite2/Font.h
+++ b/Build/source/libs/graphite2/graphite2-src/include/graphite2/Font.h
@@ -30,7 +30,7 @@
 
 #define GR2_VERSION_MAJOR   1
 #define GR2_VERSION_MINOR   3
-#define GR2_VERSION_BUGFIX  5
+#define GR2_VERSION_BUGFIX  6
 
 #ifdef __cplusplus
 extern "C"
diff --git a/Build/source/libs/graphite2/graphite2-src/src/CmapCache.cpp b/Build/source/libs/graphite2/graphite2-src/src/CmapCache.cpp
index a945ef23443..d070019a340 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/CmapCache.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/CmapCache.cpp
@@ -38,11 +38,11 @@ const void * bmp_subtable(const Face::Table & cmap)
 {
     const void * stbl;
     if (!cmap.size()) return 0;
-    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap.size()))
+    if (TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 1, cmap.size()), cmap + cmap.size())
+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 3, cmap.size()), cmap + cmap.size())
+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 2, cmap.size()), cmap + cmap.size())
+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 1, cmap.size()), cmap + cmap.size())
+     || TtfUtil::CheckCmapSubtable4(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 0, cmap.size()), cmap + cmap.size()))
         return stbl;
     return 0;
 }
@@ -51,8 +51,8 @@ const void * smp_subtable(const Face::Table & cmap)
 {
     const void * stbl;
     if (!cmap.size()) return 0;
-    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap.size())
-     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap.size()))
+    if (TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 3, 10, cmap.size()), cmap + cmap.size())
+     || TtfUtil::CheckCmapSubtable12(stbl = TtfUtil::FindCmapSubtable(cmap, 0, 4, cmap.size()), cmap + cmap.size()))
         return stbl;
     return 0;
 }
@@ -64,7 +64,7 @@ bool cache_subtable(uint16 * blocks[], const void * cst, const unsigned int limi
     int rangeKey = 0;
     uint32          codePoint = NextCodePoint(cst, 0, &rangeKey),
                     prevCodePoint = 0;
-    while (codePoint != limit)
+    while (codePoint < limit)
     {
         unsigned int block = codePoint >> 8;
         if (!blocks[block])
diff --git a/Build/source/libs/graphite2/graphite2-src/src/Code.cpp b/Build/source/libs/graphite2/graphite2-src/src/Code.cpp
index 02ad54d7dcd..aa7959708da 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/Code.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/Code.cpp
@@ -84,8 +84,9 @@ public:
     struct limits;
     struct analysis
     {
+        static const int NUMCONTEXTS = 256;
         uint8     slotref;
-        context   contexts[256];
+        context   contexts[NUMCONTEXTS];
         byte      max_ref;
         
         analysis() : slotref(0), max_ref(0) {};
@@ -368,6 +369,8 @@ opcode Machine::Code::decoder::fetch_opcode(const byte * bc)
             if (--_stack_depth < 0)
                 failure(underfull_stack);
             valid_upto(gr_slatMax, bc[0]);
+            if (attrCode(bc[0]) == gr_slatUserDefn)     // use IATTR for user attributes
+                failure(out_of_range_data);
             test_context();
             break;
         case IATTR_SET_SLOT :
@@ -381,6 +384,8 @@ opcode Machine::Code::decoder::fetch_opcode(const byte * bc)
             ++_stack_depth;
             valid_upto(gr_slatMax, bc[0]);
             valid_upto(_rule_length, _pre_context + int8(bc[1]));
+            if (attrCode(bc[0]) == gr_slatUserDefn)     // use IATTR for user attributes
+                failure(out_of_range_data);
             break;
         case PUSH_GLYPH_ATTR_OBS :
             ++_stack_depth;
@@ -661,14 +666,14 @@ bool Machine::Code::decoder::validate_opcode(const opcode opc, const byte * cons
 
 bool Machine::Code::decoder::valid_upto(const uint16 limit, const uint16 x) const throw()
 {
-    const bool t = x < limit;
+    const bool t = (limit != 0) && (x < limit);
     if (!t) failure(out_of_range_data);
     return t;
 }
 
 bool Machine::Code::decoder::test_context() const throw()
 {
-    if (_pre_context >= _rule_length)
+    if (_pre_context >= _rule_length || _analysis.slotref >= analysis::NUMCONTEXTS - 1)
     {
         failure(out_of_range_data);
         return false;
@@ -686,7 +691,7 @@ void Machine::Code::failure(const status_t s) throw() {
 inline
 void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw() {
     if (incinsert && contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
     contexts[index + slotref].flags.referenced = true;
     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
 }
@@ -695,7 +700,7 @@ void Machine::Code::decoder::analysis::set_ref(int index, bool incinsert) throw(
 inline
 void Machine::Code::decoder::analysis::set_noref(int index) throw() {
     if (contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
 }
 
@@ -703,7 +708,7 @@ void Machine::Code::decoder::analysis::set_noref(int index) throw() {
 inline
 void Machine::Code::decoder::analysis::set_changed(int index) throw() {
     if (contexts[slotref].flags.inserted) --index;
-    if (index + slotref < 0) return;
+    if (index + slotref < 0 || index + slotref >= NUMCONTEXTS) return;
     contexts[index + slotref].flags.changed = true;
     if ((index > 0 || !contexts[index + slotref].flags.inserted) && index + slotref > max_ref) max_ref = index + slotref;
 }
diff --git a/Build/source/libs/graphite2/graphite2-src/src/Face.cpp b/Build/source/libs/graphite2/graphite2-src/src/Face.cpp
index 7aefdb98de0..e9b1b1c177c 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/Face.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/Face.cpp
@@ -238,7 +238,7 @@ uint16 Face::getGlyphMetric(uint16 gid, uint8 metric) const
         case kgmetAscent : return m_ascent;
         case kgmetDescent : return m_descent;
         default: 
-            if (gid > glyphs().numGlyphs()) return 0;
+            if (gid >= glyphs().numGlyphs()) return 0;
             return glyphs().glyph(gid)->getMetric(metric);
     }
 }
diff --git a/Build/source/libs/graphite2/graphite2-src/src/FileFace.cpp b/Build/source/libs/graphite2/graphite2-src/src/FileFace.cpp
index 43aff71a719..d1510d3e9e8 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/FileFace.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/FileFace.cpp
@@ -60,8 +60,12 @@ FileFace::FileFace(const char *filename)
     if (!TtfUtil::GetTableDirInfo(_header_tbl, tbl_offset, tbl_len)) return;
     _table_dir = (TtfUtil::Sfnt::OffsetSubTable::Entry*)gralloc<char>(tbl_len);
     if (fseek(_file, tbl_offset, SEEK_SET)) return;
-    if (_table_dir)
-        if (fread(_table_dir, 1, tbl_len, _file) != tbl_len) return;
+    if (_table_dir && fread(_table_dir, 1, tbl_len, _file) != tbl_len)
+    {
+        free(_table_dir);
+        _table_dir = NULL;
+    }
+    return;
 }
 
 FileFace::~FileFace()
diff --git a/Build/source/libs/graphite2/graphite2-src/src/GlyphCache.cpp b/Build/source/libs/graphite2/graphite2-src/src/GlyphCache.cpp
index 1cd5054f71f..8792f9700b3 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/GlyphCache.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/GlyphCache.cpp
@@ -265,7 +265,7 @@ GlyphCache::Loader::Loader(const Face & face, const bool dumb_font)
     {
         if ((m_pGlat = Face::Table(face, Tag::Glat, 0x00030000)) == NULL
             || (m_pGloc = Face::Table(face, Tag::Gloc)) == NULL
-            || m_pGloc.size() < 6)
+            || m_pGloc.size() < 8)
         {
             _head = Face::Table();
             return;
diff --git a/Build/source/libs/graphite2/graphite2-src/src/Pass.cpp b/Build/source/libs/graphite2/graphite2-src/src/Pass.cpp
index f6d269931d6..fcf0384a60c 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/Pass.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/Pass.cpp
@@ -100,7 +100,9 @@ bool Pass::readPass(const byte * const pass_start, size_t pass_length, size_t su
     if (e.test(pass_length < 40, E_BADPASSLENGTH)) return face.error(e); 
     // Read in basic values
     const byte flags = be::read<byte>(p);
-    if (e.test((flags & 0x1f) && pt < PASS_TYPE_POSITIONING, E_BADCOLLISIONPASS))
+    if (e.test((flags & 0x1f) && 
+            (pt < PASS_TYPE_POSITIONING || !m_silf->aCollision() || !face.glyphs().hasBoxes()),
+            E_BADCOLLISIONPASS))
         return face.error(e);
     m_numCollRuns = flags & 0x7;
     m_kernColls   = (flags >> 3) & 0x3;
@@ -236,7 +238,7 @@ bool Pass::readRules(const byte * rule_map, const size_t num_entries,
     if (e.test(!(m_rules && m_codes && m_progs), E_OUTOFMEM)) return face.error(e);
 
     Rule * r = m_rules + m_numRules - 1;
-    for (size_t n = m_numRules; n; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
+    for (size_t n = m_numRules; r >= m_rules; --n, --r, ac_end = ac_begin, rc_end = rc_begin)
     {
         face.error_context((face.error_context() & 0xFFFF00) + EC_ARULE + ((n - 1) << 24));
         r->preContext = *--precontext;
@@ -408,6 +410,7 @@ bool Pass::runGraphite(vm::Machine & m, FiniteStateMachine & fsm, bool reverse)
         do
         {
             findNDoRule(s, m, fsm);
+            if (m.status() != Machine::finished) return false;
             if (s && (s == m.slotMap().highwater() || m.slotMap().highpassed() || --lc == 0)) {
                 if (!lc)
                     s = m.slotMap().highwater();
@@ -498,7 +501,12 @@ void Pass::findNDoRule(Slot * & slot, Machine &m, FiniteStateMachine & fsm) cons
         // Search for the first rule which passes the constraint
         const RuleEntry *        r = fsm.rules.begin(),
                         * const re = fsm.rules.end();
-        while (r != re && !testConstraint(*r->rule, m)) ++r;
+        while (r != re && !testConstraint(*r->rule, m))
+        {
+            ++r;
+            if (m.status() != Machine::finished)
+                return;
+        }
 
 #if !defined GRAPHITE2_NTRACING
         if (fsm.dbgout)
@@ -533,6 +541,7 @@ void Pass::findNDoRule(Slot * & slot, Machine &m, FiniteStateMachine & fsm) cons
             if (r != re)
             {
                 const int adv = doAction(r->rule->action, slot, m);
+                if (m.status() != Machine::finished) return;
                 if (r->rule->action->deletes()) fsm.slots.collectGarbage(slot);
                 adjustSlot(adv, slot, fsm.slots);
                 return;
diff --git a/Build/source/libs/graphite2/graphite2-src/src/Segment.cpp b/Build/source/libs/graphite2/graphite2-src/src/Segment.cpp
index 980f68c3cbc..ecc35f50aa0 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/Segment.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/Segment.cpp
@@ -210,8 +210,13 @@ void Segment::freeSlot(Slot *aSlot)
         aSlot->attachedTo()->removeChild(aSlot);
     while (aSlot->firstChild())
     {
-        aSlot->firstChild()->attachTo(NULL);
-        aSlot->removeChild(aSlot->firstChild());
+        if (aSlot->firstChild()->attachedTo() == aSlot)
+        {
+            aSlot->firstChild()->attachTo(NULL);
+            aSlot->removeChild(aSlot->firstChild());
+        }
+        else
+            aSlot->firstChild(NULL);
     }
     // reset the slot incase it is reused
     ::new (aSlot) Slot(aSlot->userAttrs());
diff --git a/Build/source/libs/graphite2/graphite2-src/src/Slot.cpp b/Build/source/libs/graphite2/graphite2-src/src/Slot.cpp
index 551bec977e5..3330c8131fb 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/Slot.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/Slot.cpp
@@ -197,6 +197,8 @@ int Slot::getAttr(const Segment *seg, attrCode ind, uint8 subindex) const
     {
         ind = gr_slatUserDefn;
         subindex = 0;
+        if (seg->numAttrs() == 0)
+            return 0;
     }
     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
     {
@@ -274,6 +276,8 @@ void Slot::setAttr(Segment *seg, attrCode ind, uint8 subindex, int16 value, cons
     {
         ind = gr_slatUserDefn;
         subindex = 0;
+        if (seg->numAttrs() == 0)
+            return;
     }
     else if (ind >= gr_slatJStretch && ind < gr_slatJStretch + 20 && ind != gr_slatJWidth)
     {
@@ -421,7 +425,7 @@ bool Slot::removeChild(Slot *ap)
     else if (ap == m_child)
     {
         Slot *nSibling = m_child->nextSibling();
-        m_child->sibling(NULL);
+        m_child->removeSibling(nSibling);
         m_child = nSibling;
         return true;
     }
@@ -436,7 +440,7 @@ bool Slot::removeSibling(Slot *ap)
     else if (ap == m_sibling)
     {
         m_sibling = m_sibling->nextSibling();
-        ap->sibling(NULL);
+        if (m_sibling) ap->removeSibling(m_sibling);
         return true;
     }
     else
diff --git a/Build/source/libs/graphite2/graphite2-src/src/TtfUtil.cpp b/Build/source/libs/graphite2/graphite2-src/src/TtfUtil.cpp
index 90ced6aee6a..85a4e6a0a81 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/TtfUtil.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/TtfUtil.cpp
@@ -889,8 +889,9 @@ const void * FindCmapSubtable(const void * pCmap, int nPlatformId, /* =3 */ int
 /*----------------------------------------------------------------------------------------------
     Check the Microsoft Unicode subtable for expected values
 ----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable4(const void * pCmapSubtable4, size_t table_len /*, unsigned int maxgid*/)
+bool CheckCmapSubtable4(const void * pCmapSubtable4, const void * pCmapEnd /*, unsigned int maxgid*/)
 {
+    size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable4;
     if (!pCmapSubtable4) return false;
     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable4);
     // Bob H say some freeware TT fonts have version 1 (eg, CALIGULA.TTF) 
@@ -1049,7 +1050,7 @@ unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnico
     // Just in case we have a bad key:
     while (iRange > 0 && be::peek<uint16>(pStartCode + iRange) > nUnicodePrev)
         iRange--;
-    while (be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
+    while (iRange < nRange - 1 && be::peek<uint16>(pTable->end_code + iRange) < nUnicodePrev)
         iRange++;
 
     // Now iRange is the range containing nUnicodePrev.
@@ -1074,14 +1075,15 @@ unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnico
     // ends with 0xFFFF.
     if (pRangeKey)
         *pRangeKey = iRange + 1;
-    return be::peek<uint16>(pStartCode + iRange + 1);
+    return (iRange + 1 >= nRange) ? 0xFFFF : be::peek<uint16>(pStartCode + iRange + 1);
 }
 
 /*----------------------------------------------------------------------------------------------
     Check the Microsoft UCS-4 subtable for expected values.
 ----------------------------------------------------------------------------------------------*/
-bool CheckCmapSubtable12(const void *pCmapSubtable12, size_t table_len /*, unsigned int maxgid*/)
+bool CheckCmapSubtable12(const void *pCmapSubtable12, const void *pCmapEnd /*, unsigned int maxgid*/)
 {
+    size_t table_len = (const byte *)pCmapEnd - (const byte *)pCmapSubtable12;
     if (!pCmapSubtable12)  return false;
     const Sfnt::CmapSubTable * pTable = reinterpret_cast<const Sfnt::CmapSubTable *>(pCmapSubtable12);
     if (be::swap(pTable->format) != 12)
@@ -1093,7 +1095,7 @@ bool CheckCmapSubtable12(const void *pCmapSubtable12, size_t table_len /*, unsig
     if (length < sizeof(Sfnt::CmapSubTableFormat12))
         return false;
     uint32 num_groups = be::swap(pTable12->num_groups);
-    if (length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
+    if (num_groups > 0x10000000 || length != (sizeof(Sfnt::CmapSubTableFormat12) + (num_groups - 1) * sizeof(uint32) * 3))
         return false;
 #if 0
     for (unsigned int i = 0; i < num_groups; ++i)
@@ -1166,7 +1168,7 @@ unsigned int CmapSubtable12NextCodepoint(const void *pCmap310, unsigned int nUni
     // Just in case we have a bad key:
     while (iRange > 0 && be::swap(pTable->group[iRange].start_char_code) > nUnicodePrev)
         iRange--;
-    while (be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
+    while (iRange < nRange - 1 && be::swap(pTable->group[iRange].end_char_code) < nUnicodePrev)
         iRange++;
 
     // Now iRange is the range containing nUnicodePrev.
diff --git a/Build/source/libs/graphite2/graphite2-src/src/call_machine.cpp b/Build/source/libs/graphite2/graphite2-src/src/call_machine.cpp
index e1d0ce5d2ff..09c2038c410 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/call_machine.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/call_machine.cpp
@@ -72,6 +72,7 @@ struct regbank  {
     const instr * & ip;
     uint8           direction;
     int8            flags;
+    Machine::status_t & status;
 };
 
 typedef bool        (* ip_t)(registers);
@@ -88,6 +89,7 @@ namespace {
 #define mapb    reg.map_base
 #define flags   reg.flags
 #define dir     reg.direction
+#define status  reg.status
 
 #include "inc/opcodes.h"
 
@@ -113,7 +115,7 @@ Machine::stack_t  Machine::run(const instr   * program,
     const byte    * dp = data;
     stack_t       * sp = _stack + Machine::STACK_GUARD,
             * const sb = sp;
-    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0};
+    regbank         reg = {*map, map, _map, _map.begin()+_map.context(), ip, _map.dir(), 0, _status};
 
     // Run the program        
     while ((reinterpret_cast<ip_t>(*++ip))(dp, sp, sb, reg)) {}
diff --git a/Build/source/libs/graphite2/graphite2-src/src/direct_machine.cpp b/Build/source/libs/graphite2/graphite2-src/src/direct_machine.cpp
index b6b9ee04235..7d80438fb42 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/direct_machine.cpp
+++ b/Build/source/libs/graphite2/graphite2-src/src/direct_machine.cpp
@@ -62,6 +62,7 @@ const void * direct_run(const bool          get_table_mode,
                         Machine::stack_t  * stack,
                         slotref         * & __map,
                         uint8                _dir,
+                        Machine::status_t & status,
                         SlotMap           * __smap=0)
 {
     // We need to define and return to opcode table from within this function 
@@ -71,17 +72,17 @@ const void * direct_run(const bool          get_table_mode,
         return opcode_table;
 
     // Declare virtual machine registers
-    const instr       * ip = program;
-    const byte        * dp = data;
-    Machine::stack_t  * sp = stack + Machine::STACK_GUARD,
-                * const sb = sp;
-    SlotMap         & smap = *__smap;
-    Segment          & seg = smap.segment;
-    slotref             is = *__map,
-                     * map = __map,
-              * const mapb = smap.begin()+smap.context();
-    uint8            dir = _dir;
-    int8             flags = 0;
+    const instr           * ip = program;
+    const byte            * dp = data;
+    Machine::stack_t      * sp = stack + Machine::STACK_GUARD,
+                    * const sb = sp;
+    SlotMap             & smap = *__smap;
+    Segment              & seg = smap.segment;
+    slotref                 is = *__map,
+                         * map = __map,
+                  * const mapb = smap.begin()+smap.context();
+    uint8                  dir = _dir;
+    int8                 flags = 0;
     
     // start the program
     goto **ip;
@@ -100,7 +101,8 @@ const void * direct_run(const bool          get_table_mode,
 const opcode_t * Machine::getOpcodeTable() throw()
 {
     slotref * dummy;
-    return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0));
+    Machine::status_t dumstat = Machine::finished;
+    return static_cast<const opcode_t *>(direct_run(true, 0, 0, 0, dummy, 0, dumstat));
 }
 
 
@@ -111,7 +113,7 @@ Machine::stack_t  Machine::run(const instr   * program,
     assert(program != 0);
     
     const stack_t *sp = static_cast<const stack_t *>(
-                direct_run(false, program, data, _stack, is, _map.dir(), &_map));
+                direct_run(false, program, data, _stack, is, _map.dir(), _status, &_map));
     const stack_t ret = sp == _stack+STACK_GUARD+1 ? *sp-- : 0;
     check_final_stack(sp);
     return ret;
diff --git a/Build/source/libs/graphite2/graphite2-src/src/inc/Code.h b/Build/source/libs/graphite2/graphite2-src/src/inc/Code.h
index 02d09a109d6..5451a34809b 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/inc/Code.h
+++ b/Build/source/libs/graphite2/graphite2-src/src/inc/Code.h
@@ -114,7 +114,7 @@ public:
 inline
 size_t  Machine::Code::estimateCodeDataOut(size_t n_bc)
 {
-    return n_bc * (sizeof(instr)+sizeof(byte));
+    return (n_bc + 1) * (sizeof(instr)+sizeof(byte));
 }
 
 
diff --git a/Build/source/libs/graphite2/graphite2-src/src/inc/GlyphCache.h b/Build/source/libs/graphite2/graphite2-src/src/inc/GlyphCache.h
index cf7c2469c3c..3c0add58d07 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/inc/GlyphCache.h
+++ b/Build/source/libs/graphite2/graphite2-src/src/inc/GlyphCache.h
@@ -112,6 +112,7 @@ public:
     const SlantBox & getSubBoundingSlantBox(unsigned short glyphid, uint8 subindex) const;
     const BBox &     getSubBoundingBBox(unsigned short glyphid, uint8 subindex) const;
     bool             check(unsigned short glyphid) const;
+    bool             hasBoxes() const { return _boxes != 0; }
 
     CLASS_NEW_DELETE;
     
diff --git a/Build/source/libs/graphite2/graphite2-src/src/inc/Machine.h b/Build/source/libs/graphite2/graphite2-src/src/inc/Machine.h
index 4efb70cd946..d7bb4f389fd 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/inc/Machine.h
+++ b/Build/source/libs/graphite2/graphite2-src/src/inc/Machine.h
@@ -140,7 +140,8 @@ public:
         stack_underflow,
         stack_not_empty,
         stack_overflow,
-        slot_offset_out_bounds
+        slot_offset_out_bounds,
+        died_early
     };
 
     Machine(SlotMap &) throw();
diff --git a/Build/source/libs/graphite2/graphite2-src/src/inc/TtfUtil.h b/Build/source/libs/graphite2/graphite2-src/src/inc/TtfUtil.h
index 43ef2daa9ed..fe1c2a585fc 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/inc/TtfUtil.h
+++ b/Build/source/libs/graphite2/graphite2-src/src/inc/TtfUtil.h
@@ -137,11 +137,11 @@ public:
     ////////////////////////////////// cmap lookup tools 
     const void * FindCmapSubtable(const void * pCmap, int nPlatformId = 3, 
         int nEncodingId = 1, size_t length = 0);
-    bool CheckCmapSubtable4(const void * pCmap31, size_t table_len /*, unsigned int maxgid*/);
+    bool CheckCmapSubtable4(const void * pCmap31, const void * pCmapEnd /*, unsigned int maxgid*/);
     gid16 CmapSubtable4Lookup(const void * pCmapSubtabel4, unsigned int nUnicodeId, int rangeKey = 0);
     unsigned int CmapSubtable4NextCodepoint(const void *pCmap31, unsigned int nUnicodeId,
         int * pRangeKey = 0);
-    bool CheckCmapSubtable12(const void *pCmap310, size_t table_len /*, unsigned int maxgid*/);
+    bool CheckCmapSubtable12(const void *pCmap310, const void * pCmapEnd /*, unsigned int maxgid*/);
     gid16 CmapSubtable12Lookup(const void * pCmap310, unsigned int uUnicodeId, int rangeKey = 0);
     unsigned int CmapSubtable12NextCodepoint(const void *pCmap310, unsigned int nUnicodeId,
         int * pRangeKey = 0);
diff --git a/Build/source/libs/graphite2/graphite2-src/src/inc/opcodes.h b/Build/source/libs/graphite2/graphite2-src/src/inc/opcodes.h
index ce87092b64f..76da50bf409 100644
--- a/Build/source/libs/graphite2/graphite2-src/src/inc/opcodes.h
+++ b/Build/source/libs/graphite2/graphite2-src/src/inc/opcodes.h
@@ -76,7 +76,7 @@ of the License or (at your option) any later version.
 #define push(n)             { *++sp = n; }
 #define pop()               (*sp--)
 #define slotat(x)           (map[(x)])
-#define DIE                 { is=seg.last(); EXIT(1); }
+#define DIE                 { is=seg.last(); status = Machine::died_early; EXIT(1); }
 #define POSITIONED          1
 
 STARTOP(nop)
@@ -392,7 +392,7 @@ STARTOP(attr_add)
     const          int  val  = int(pop());
     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
         flags |= POSITIONED;
     }
     int res = is->getAttr(&seg, slat, 0);
@@ -405,7 +405,7 @@ STARTOP(attr_sub)
     const          int  val  = int(pop());
     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
         flags |= POSITIONED;
     }
     int res = is->getAttr(&seg, slat, 0);
@@ -434,7 +434,7 @@ STARTOP(push_slot_attr)
     const int           slot_ref = int8(param[1]);
     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
         flags |= POSITIONED;
     }
     slotref slot = slotat(slot_ref);
@@ -510,7 +510,7 @@ STARTOP(push_islot_attr)
                         idx      = uint8(param[2]);
     if ((slat == gr_slatPosX || slat == gr_slatPosY) && (flags & POSITIONED) == 0)
     {
-        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), dir);
+        seg.positionSlots(0, *smap.begin(), *(smap.end()-1), seg.currdir());
         flags |= POSITIONED;
     }
     slotref slot = slotat(slot_ref);
diff --git a/Build/source/libs/graphite2/version.ac b/Build/source/libs/graphite2/version.ac
index ed721a18c23..10ef86c5e7e 100644
--- a/Build/source/libs/graphite2/version.ac
+++ b/Build/source/libs/graphite2/version.ac
@@ -8,4 +8,4 @@ dnl
 dnl --------------------------------------------------------
 dnl
 dnl  m4-include this file to define the current graphite2 version
-m4_define([graphite2_version], [1.3.5])
+m4_define([graphite2_version], [1.3.6])