summaryrefslogtreecommitdiff
path: root/Build/source/libs/freetype2/freetype-src/src/cid
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/cid')
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c31
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidload.c92
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidload.h2
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c11
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c6
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h2
6 files changed, 74 insertions, 70 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c
index bd0a7e7fb10..a46d063dfeb 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c
@@ -63,7 +63,7 @@
#endif
- FT_TRACE1(( "cid_load_glyph: glyph index %d\n", glyph_index ));
+ FT_TRACE1(( "cid_load_glyph: glyph index %u\n", glyph_index ));
#ifdef FT_CONFIG_OPTION_INCREMENTAL
@@ -76,20 +76,17 @@
error = inc->funcs->get_glyph_data( inc->object,
glyph_index, &glyph_data );
- if ( error )
+ if ( error || glyph_data.length < cid->fd_bytes )
goto Exit;
p = (FT_Byte*)glyph_data.pointer;
- fd_select = cid_get_offset( &p, (FT_Byte)cid->fd_bytes );
+ fd_select = cid_get_offset( &p, cid->fd_bytes );
- if ( glyph_data.length != 0 )
- {
- glyph_length = (FT_ULong)( glyph_data.length - cid->fd_bytes );
+ glyph_length = glyph_data.length - cid->fd_bytes;
- if ( !FT_QALLOC( charstring, glyph_length ) )
- FT_MEM_COPY( charstring, glyph_data.pointer + cid->fd_bytes,
- glyph_length );
- }
+ if ( !FT_QALLOC( charstring, glyph_length ) )
+ FT_MEM_COPY( charstring, glyph_data.pointer + cid->fd_bytes,
+ glyph_length );
inc->funcs->free_glyph_data( inc->object, &glyph_data );
@@ -104,7 +101,7 @@
/* For ordinary fonts read the CID font dictionary index */
/* and charstring offset from the CIDMap. */
{
- FT_UInt entry_len = (FT_UInt)( cid->fd_bytes + cid->gd_bytes );
+ FT_UInt entry_len = cid->fd_bytes + cid->gd_bytes;
FT_ULong off1, off2;
@@ -114,15 +111,15 @@
goto Exit;
p = (FT_Byte*)stream->cursor;
- fd_select = cid_get_offset( &p, (FT_Byte)cid->fd_bytes );
- off1 = cid_get_offset( &p, (FT_Byte)cid->gd_bytes );
+ fd_select = cid_get_offset( &p, cid->fd_bytes );
+ off1 = cid_get_offset( &p, cid->gd_bytes );
p += cid->fd_bytes;
- off2 = cid_get_offset( &p, (FT_Byte)cid->gd_bytes );
+ off2 = cid_get_offset( &p, cid->gd_bytes );
FT_FRAME_EXIT();
- if ( fd_select >= (FT_ULong)cid->num_dicts ||
- off2 > stream->size ||
- off1 > off2 )
+ if ( fd_select >= cid->num_dicts ||
+ off2 > stream->size ||
+ off1 > off2 )
{
FT_TRACE0(( "cid_load_glyph: invalid glyph stream offsets\n" ));
error = FT_THROW( Invalid_Offset );
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c
index 7fd0d7c78c2..496219de804 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c
@@ -41,7 +41,7 @@
/* read a single offset */
FT_LOCAL_DEF( FT_ULong )
cid_get_offset( FT_Byte* *start,
- FT_Byte offsize )
+ FT_UInt offsize )
{
FT_ULong result;
FT_Byte* p = *start;
@@ -113,7 +113,7 @@
CID_FaceDict dict;
- if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
+ if ( parser->num_dict >= cid->num_dicts )
{
FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
keyword->ident ));
@@ -164,7 +164,7 @@
FT_Fixed temp_scale;
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ if ( parser->num_dict < face->cid.num_dicts )
{
FT_Matrix* matrix;
FT_Vector* offset;
@@ -244,11 +244,11 @@
FT_Memory memory = face->root.memory;
FT_Stream stream = parser->stream;
FT_Error error = FT_Err_Ok;
- FT_Long num_dicts;
+ FT_Long num_dicts, max_dicts;
num_dicts = cid_parser_to_int( parser );
- if ( num_dicts < 0 )
+ if ( num_dicts < 0 || num_dicts > FT_INT_MAX )
{
FT_ERROR(( "parse_fd_array: invalid number of dictionaries\n" ));
goto Exit;
@@ -272,18 +272,18 @@
* need a `dup X' at the very beginning and a `put' at the end, so a
* rough guess using 100 bytes as the minimum is justified.
*/
- if ( (FT_ULong)num_dicts > stream->size / 100 )
+ max_dicts = (FT_Long)( stream->size / 100 );
+ if ( num_dicts > max_dicts )
{
FT_TRACE0(( "parse_fd_array: adjusting FDArray size"
" (from %ld to %ld)\n",
- num_dicts,
- stream->size / 100 ));
- num_dicts = (FT_Long)( stream->size / 100 );
+ num_dicts, max_dicts ));
+ num_dicts = max_dicts;
}
if ( !cid->font_dicts )
{
- FT_Int n;
+ FT_UInt n;
if ( FT_NEW_ARRAY( cid->font_dicts, num_dicts ) )
@@ -322,7 +322,7 @@
CID_FaceDict dict;
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ if ( parser->num_dict < face->cid.num_dicts )
{
dict = face->cid.font_dicts + parser->num_dict;
@@ -345,7 +345,7 @@
CID_Parser* parser )
{
#ifdef FT_DEBUG_LEVEL_TRACE
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ if ( parser->num_dict < face->cid.num_dicts )
{
T1_TokenRec token;
FT_UInt len;
@@ -427,7 +427,7 @@
parser->num_dict++;
#ifdef FT_DEBUG_LEVEL_TRACE
- FT_TRACE4(( " FontDict %d", parser->num_dict ));
+ FT_TRACE4(( " FontDict %u", parser->num_dict ));
if ( parser->num_dict > face->cid.num_dicts )
FT_TRACE4(( " (ignored)" ));
FT_TRACE4(( "\n" ));
@@ -517,7 +517,7 @@
FT_Memory memory = face->root.memory;
FT_Stream stream = face->cid_stream;
FT_Error error;
- FT_Int n;
+ FT_UInt n;
CID_Subrs subr;
FT_UInt max_offsets = 0;
FT_ULong* offsets = NULL;
@@ -559,13 +559,13 @@
}
/* read the subrmap's offsets */
- if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) ||
- FT_FRAME_ENTER( ( num_subrs + 1 ) * (FT_UInt)dict->sd_bytes ) )
+ if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) ||
+ FT_FRAME_ENTER( ( num_subrs + 1 ) * dict->sd_bytes ) )
goto Fail;
p = (FT_Byte*)stream->cursor;
for ( count = 0; count <= num_subrs; count++ )
- offsets[count] = cid_get_offset( &p, (FT_Byte)dict->sd_bytes );
+ offsets[count] = cid_get_offset( &p, dict->sd_bytes );
FT_FRAME_EXIT();
@@ -594,7 +594,7 @@
goto Fail;
if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
- FT_STREAM_READ( subr->code[0], data_len ) )
+ FT_STREAM_READ( subr->code[0], data_len ) )
goto Fail;
/* set up pointers */
@@ -771,12 +771,11 @@
CID_Parser* parser;
FT_Memory memory = face->root.memory;
FT_Error error;
- FT_Int n;
+ FT_UInt n;
CID_FaceInfo cid = &face->cid;
FT_ULong binary_length;
- FT_ULong entry_len;
cid_init_loader( &loader, face );
@@ -805,7 +804,7 @@
face->root.stream->size - parser->data_offset )
{
FT_TRACE0(( "cid_face_open: adjusting length of binary data\n" ));
- FT_TRACE0(( " (from %ld to %ld bytes)\n",
+ FT_TRACE0(( " (from %lu to %lu bytes)\n",
parser->binary_length,
face->root.stream->size - parser->data_offset ));
parser->binary_length = face->root.stream->size -
@@ -833,10 +832,10 @@
/* sanity tests */
- if ( cid->fd_bytes < 0 || cid->gd_bytes < 1 )
+ if ( cid->gd_bytes == 0 )
{
FT_ERROR(( "cid_face_open:"
- " Invalid `FDBytes' or `GDBytes' value\n" ));
+ " Invalid `GDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
@@ -853,7 +852,24 @@
}
binary_length = face->cid_stream->size - cid->data_offset;
- entry_len = (FT_ULong)( cid->fd_bytes + cid->gd_bytes );
+
+ if ( cid->cidmap_offset > binary_length )
+ {
+ FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
+ /* the initial pre-check prevents the multiplication overflow */
+ if ( cid->cid_count > FT_ULONG_MAX / 8 ||
+ cid->cid_count * ( cid->fd_bytes + cid->gd_bytes ) >
+ binary_length - cid->cidmap_offset )
+ {
+ FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
for ( n = 0; n < cid->num_dicts; n++ )
{
@@ -879,8 +895,7 @@
dict->private_dict.blue_fuzz = 1;
}
- if ( dict->sd_bytes < 0 ||
- ( dict->num_subrs && dict->sd_bytes < 1 ) )
+ if ( dict->num_subrs && dict->sd_bytes == 0 )
{
FT_ERROR(( "cid_face_open: Invalid `SDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
@@ -903,11 +918,10 @@
goto Exit;
}
- /* `num_subrs' is scanned as a signed integer */
- if ( (FT_Int)dict->num_subrs < 0 ||
- ( dict->sd_bytes &&
- dict->num_subrs > ( binary_length - dict->subrmap_offset ) /
- (FT_UInt)dict->sd_bytes ) )
+ /* the initial pre-check prevents the multiplication overflow */
+ if ( dict->num_subrs > FT_UINT_MAX / 4 ||
+ dict->num_subrs * dict->sd_bytes >
+ binary_length - dict->subrmap_offset )
{
FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
@@ -915,22 +929,6 @@
}
}
- if ( cid->cidmap_offset > binary_length )
- {
- FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
- error = FT_THROW( Invalid_File_Format );
- goto Exit;
- }
-
- if ( entry_len &&
- cid->cid_count >
- ( binary_length - cid->cidmap_offset ) / entry_len )
- {
- FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
- error = FT_THROW( Invalid_File_Format );
- goto Exit;
- }
-
/* we can now safely proceed */
error = cid_read_subrs( face );
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h
index 456685c2af1..ee1d4865055 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h
@@ -37,7 +37,7 @@ FT_BEGIN_HEADER
FT_LOCAL( FT_ULong )
cid_get_offset( FT_Byte** start,
- FT_Byte offsize );
+ FT_UInt offsize );
FT_LOCAL( FT_Error )
cid_face_open( CID_Face face,
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c
index c7568118547..e3c29c22f67 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c
@@ -157,10 +157,14 @@
cid_size_request( FT_Size size,
FT_Size_Request req )
{
+ FT_Error error;
+
PSH_Globals_Funcs funcs;
- FT_Request_Metrics( size->face, req );
+ error = FT_Request_Metrics( size->face, req );
+ if ( error )
+ goto Exit;
funcs = cid_size_get_globals_funcs( (CID_Size)size );
@@ -170,7 +174,8 @@
size->metrics.y_scale,
0, 0 );
- return FT_Err_Ok;
+ Exit:
+ return error;
}
@@ -211,7 +216,7 @@
/* release subrs */
if ( face->subrs )
{
- FT_Int n;
+ FT_UInt n;
for ( n = 0; n < cid->num_dicts; n++ )
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c
index a28f8ee5590..852c9b6b965 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c
@@ -73,7 +73,11 @@
/* first of all, check the font format in the header */
if ( FT_FRAME_ENTER( 31 ) )
+ {
+ FT_TRACE2(( " not a CID-keyed font\n" ));
+ error = FT_THROW( Unknown_File_Format );
goto Exit;
+ }
if ( ft_strncmp( (char *)stream->cursor,
"%!PS-Adobe-3.0 Resource-CIDFont", 31 ) )
@@ -181,7 +185,7 @@
parser->root.base = parser->postscript;
parser->root.cursor = parser->postscript;
parser->root.limit = parser->root.cursor + ps_len;
- parser->num_dict = -1;
+ parser->num_dict = FT_UINT_MAX;
/* Finally, we check whether `StartData' or `/sfnts' was real -- */
/* it could be in a comment or string. We also get the arguments */
diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h
index 6a00c6cee12..fbc437bc380 100644
--- a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h
+++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h
@@ -78,7 +78,7 @@ FT_BEGIN_HEADER
FT_ULong binary_length;
CID_FaceInfo cid;
- FT_Int num_dict;
+ FT_UInt num_dict;
} CID_Parser;