summaryrefslogtreecommitdiff
path: root/Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c')
-rw-r--r--Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c234
1 files changed, 159 insertions, 75 deletions
diff --git a/Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c b/Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c
index aad3e2929aa..7f2db0cbdc0 100644
--- a/Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c
+++ b/Build/source/libs/freetype2/freetype-src/src/truetype/ttgxvar.c
@@ -178,7 +178,7 @@
/* in the nested loops below we increase `i' twice; */
/* it is faster to simply allocate one more slot */
/* than to add another test within the loop */
- if ( FT_NEW_ARRAY( points, n + 1 ) )
+ if ( FT_QNEW_ARRAY( points, n + 1 ) )
return NULL;
*point_cnt = n;
@@ -264,55 +264,80 @@
FT_Fixed *deltas = NULL;
FT_UInt runcnt, cnt;
FT_UInt i, j;
+ FT_UInt bytes_used;
FT_Memory memory = stream->memory;
FT_Error error = FT_Err_Ok;
FT_UNUSED( error );
- if ( delta_cnt > size )
- {
- FT_TRACE1(( "ft_var_readpackeddeltas: number of points too large\n" ));
+ if ( FT_QNEW_ARRAY( deltas, delta_cnt ) )
return NULL;
- }
- if ( FT_NEW_ARRAY( deltas, delta_cnt ) )
- return NULL;
+ i = 0;
+ bytes_used = 0;
- i = 0;
- while ( i < delta_cnt )
+ while ( i < delta_cnt && bytes_used < size )
{
runcnt = FT_GET_BYTE();
cnt = runcnt & GX_DT_DELTA_RUN_COUNT_MASK;
+ bytes_used++;
+
if ( runcnt & GX_DT_DELTAS_ARE_ZERO )
{
- /* `runcnt' zeroes get added */
+ /* `cnt` + 1 zeroes get added */
for ( j = 0; j <= cnt && i < delta_cnt; j++ )
deltas[i++] = 0;
}
else if ( runcnt & GX_DT_DELTAS_ARE_WORDS )
{
- /* `runcnt' shorts from the stack */
+ /* `cnt` + 1 shorts from the stack */
+ bytes_used += 2 * ( cnt + 1 );
+ if ( bytes_used > size )
+ {
+ FT_TRACE1(( "ft_var_readpackeddeltas:"
+ " number of short deltas too large\n" ));
+ goto Fail;
+ }
+
for ( j = 0; j <= cnt && i < delta_cnt; j++ )
deltas[i++] = FT_intToFixed( FT_GET_SHORT() );
}
else
{
- /* `runcnt' signed bytes from the stack */
+ /* `cnt` + 1 signed bytes from the stack */
+ bytes_used += cnt + 1;
+ if ( bytes_used > size )
+ {
+ FT_TRACE1(( "ft_var_readpackeddeltas:"
+ " number of byte deltas too large\n" ));
+ goto Fail;
+ }
+
for ( j = 0; j <= cnt && i < delta_cnt; j++ )
deltas[i++] = FT_intToFixed( FT_GET_CHAR() );
}
if ( j <= cnt )
{
- /* bad format */
- FT_FREE( deltas );
- return NULL;
+ FT_TRACE1(( "ft_var_readpackeddeltas:"
+ " number of deltas too large\n" ));
+ goto Fail;
}
}
+ if ( i < delta_cnt )
+ {
+ FT_TRACE1(( "ft_var_readpackeddeltas: not enough deltas\n" ));
+ goto Fail;
+ }
+
return deltas;
+
+ Fail:
+ FT_FREE( deltas );
+ return NULL;
}
@@ -377,7 +402,7 @@
goto Exit;
}
- if ( FT_NEW_ARRAY( blend->avar_segment, axisCount ) )
+ if ( FT_QNEW_ARRAY( blend->avar_segment, axisCount ) )
goto Exit;
segment = &blend->avar_segment[0];
@@ -386,8 +411,8 @@
FT_TRACE5(( " axis %d:\n", i ));
segment->pairCount = FT_GET_USHORT();
- if ( (FT_ULong)segment->pairCount * 4 > table_len ||
- FT_NEW_ARRAY( segment->correspondence, segment->pairCount ) )
+ if ( (FT_ULong)segment->pairCount * 4 > table_len ||
+ FT_QNEW_ARRAY( segment->correspondence, segment->pairCount ) )
{
/* Failure. Free everything we have done so far. We must do */
/* it right now since loading the `avar' table is optional. */
@@ -432,7 +457,8 @@
FT_UShort format;
FT_ULong region_offset;
FT_UInt i, j, k;
- FT_UInt shortDeltaCount;
+ FT_UInt wordDeltaCount;
+ FT_Bool long_words;
GX_Blend blend = face->blend;
GX_ItemVarData varData;
@@ -467,7 +493,7 @@
/* make temporary copy of item variation data offsets; */
/* we will parse region list first, then come back */
- if ( FT_NEW_ARRAY( dataOffsetArray, itemStore->dataCount ) )
+ if ( FT_QNEW_ARRAY( dataOffsetArray, itemStore->dataCount ) )
goto Exit;
for ( i = 0; i < itemStore->dataCount; i++ )
@@ -547,15 +573,18 @@
goto Exit;
if ( FT_READ_USHORT( varData->itemCount ) ||
- FT_READ_USHORT( shortDeltaCount ) ||
+ FT_READ_USHORT( wordDeltaCount ) ||
FT_READ_USHORT( varData->regionIdxCount ) )
goto Exit;
+ long_words = !!( wordDeltaCount & 0x8000 );
+ wordDeltaCount &= 0x7FFF;
+
/* check some data consistency */
- if ( shortDeltaCount > varData->regionIdxCount )
+ if ( wordDeltaCount > varData->regionIdxCount )
{
FT_TRACE2(( "bad short count %d or region count %d\n",
- shortDeltaCount,
+ wordDeltaCount,
varData->regionIdxCount ));
error = FT_THROW( Invalid_Table );
goto Exit;
@@ -591,39 +620,52 @@
/* Parse delta set. */
/* */
- /* On input, deltas are (shortDeltaCount + regionIdxCount) bytes */
- /* each; on output, deltas are expanded to `regionIdxCount' shorts */
- /* each. */
+ /* On input, deltas are (wordDeltaCount + regionIdxCount) bytes */
+ /* each if `long_words` isn't set, and twice as much otherwise. */
+ /* */
+ /* On output, deltas are expanded to `regionIdxCount` shorts each. */
if ( FT_NEW_ARRAY( varData->deltaSet,
varData->regionIdxCount * varData->itemCount ) )
goto Exit;
- /* the delta set is stored as a 2-dimensional array of shorts; */
- /* sign-extend signed bytes to signed shorts */
- for ( j = 0; j < varData->itemCount * varData->regionIdxCount; )
+ /* the delta set is stored as a 2-dimensional array of shorts */
+ if ( long_words )
+ {
+ /* new in OpenType 1.9, currently for 'COLR' table only; */
+ /* the deltas are interpreted as 16.16 fixed-point scaling values */
+
+ /* not supported yet */
+
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+ else
{
- for ( k = 0; k < shortDeltaCount; k++, j++ )
+ for ( j = 0; j < varData->itemCount * varData->regionIdxCount; )
{
- /* read the short deltas */
- FT_Short delta;
+ for ( k = 0; k < wordDeltaCount; k++, j++ )
+ {
+ /* read the short deltas */
+ FT_Short delta;
- if ( FT_READ_SHORT( delta ) )
- goto Exit;
+ if ( FT_READ_SHORT( delta ) )
+ goto Exit;
- varData->deltaSet[j] = delta;
- }
+ varData->deltaSet[j] = delta;
+ }
- for ( ; k < varData->regionIdxCount; k++, j++ )
- {
- /* read the (signed) byte deltas */
- FT_Char delta;
+ for ( ; k < varData->regionIdxCount; k++, j++ )
+ {
+ /* read the (signed) byte deltas */
+ FT_Char delta;
- if ( FT_READ_CHAR( delta ) )
- goto Exit;
+ if ( FT_READ_CHAR( delta ) )
+ goto Exit;
- varData->deltaSet[j] = delta;
+ varData->deltaSet[j] = delta;
+ }
}
}
}
@@ -639,37 +681,66 @@
ft_var_load_delta_set_index_mapping( TT_Face face,
FT_ULong offset,
GX_DeltaSetIdxMap map,
- GX_ItemVarStore itemStore )
+ GX_ItemVarStore itemStore,
+ FT_ULong table_len )
{
FT_Stream stream = FT_FACE_STREAM( face );
FT_Memory memory = stream->memory;
- FT_Error error;
+ FT_Error error;
- FT_UShort format;
- FT_UInt entrySize;
- FT_UInt innerBitCount;
- FT_UInt innerIndexMask;
- FT_UInt i, j;
+ FT_Byte format;
+ FT_Byte entryFormat;
+ FT_UInt entrySize;
+ FT_UInt innerBitCount;
+ FT_UInt innerIndexMask;
+ FT_ULong i;
+ FT_UInt j;
- if ( FT_STREAM_SEEK( offset ) ||
- FT_READ_USHORT( format ) ||
- FT_READ_USHORT( map->mapCount ) )
+ if ( FT_STREAM_SEEK( offset ) ||
+ FT_READ_BYTE( format ) ||
+ FT_READ_BYTE( entryFormat ) )
goto Exit;
- if ( format & 0xFFC0 )
+ if ( format == 0 )
+ {
+ if ( FT_READ_USHORT( map->mapCount ) )
+ goto Exit;
+ }
+ else if ( format == 1 ) /* new in OpenType 1.9 */
+ {
+ if ( FT_READ_ULONG( map->mapCount ) )
+ goto Exit;
+ }
+ else
{
FT_TRACE2(( "bad map format %d\n", format ));
error = FT_THROW( Invalid_Table );
goto Exit;
}
+ if ( entryFormat & 0xC0 )
+ {
+ FT_TRACE2(( "bad entry format %d\n", format ));
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+
/* bytes per entry: 1, 2, 3, or 4 */
- entrySize = ( ( format & 0x0030 ) >> 4 ) + 1;
- innerBitCount = ( format & 0x000F ) + 1;
+ entrySize = ( ( entryFormat & 0x30 ) >> 4 ) + 1;
+ innerBitCount = ( entryFormat & 0x0F ) + 1;
innerIndexMask = ( 1 << innerBitCount ) - 1;
+ /* rough sanity check */
+ if ( map->mapCount * entrySize > table_len )
+ {
+ FT_TRACE1(( "ft_var_load_delta_set_index_mapping:"
+ " invalid number of delta-set index mappings\n" ));
+ error = FT_THROW( Invalid_Table );
+ goto Exit;
+ }
+
if ( FT_NEW_ARRAY( map->innerIndex, map->mapCount ) )
goto Exit;
@@ -698,7 +769,7 @@
if ( outerIndex >= itemStore->dataCount )
{
- FT_TRACE2(( "outerIndex[%d] == %d out of range\n",
+ FT_TRACE2(( "outerIndex[%ld] == %d out of range\n",
i,
outerIndex ));
error = FT_THROW( Invalid_Table );
@@ -711,7 +782,7 @@
if ( innerIndex >= itemStore->varData[outerIndex].itemCount )
{
- FT_TRACE2(( "innerIndex[%d] == %d out of range\n",
+ FT_TRACE2(( "innerIndex[%ld] == %d out of range\n",
i,
innerIndex ));
error = FT_THROW( Invalid_Table );
@@ -836,7 +907,8 @@
face,
table_offset + widthMap_offset,
&table->widthMap,
- &table->itemStore );
+ &table->itemStore,
+ table_len );
if ( error )
goto Exit;
}
@@ -1569,7 +1641,7 @@
goto Exit;
/* offsets (one more offset than glyphs, to mark size of last) */
- if ( FT_NEW_ARRAY( blend->glyphoffsets, gvar_head.glyphCount + 1 ) )
+ if ( FT_QNEW_ARRAY( blend->glyphoffsets, gvar_head.glyphCount + 1 ) )
goto Fail2;
if ( gvar_head.flags & 1 )
@@ -1648,8 +1720,8 @@
goto Fail;
}
- if ( FT_NEW_ARRAY( blend->tuplecoords,
- gvar_head.axisCount * gvar_head.globalCoordCount ) )
+ if ( FT_QNEW_ARRAY( blend->tuplecoords,
+ gvar_head.axisCount * gvar_head.globalCoordCount ) )
goto Fail2;
for ( i = 0; i < gvar_head.globalCoordCount; i++ )
@@ -1858,19 +1930,16 @@
" clamping\n",
a->minimum / 65536.0,
a->maximum / 65536.0 ));
-
- if ( coord > a->maximum )
- coord = a->maximum;
- else
- coord = a->minimum;
}
- if ( coord < a->def )
- normalized[i] = -FT_DivFix( SUB_LONG( coord, a->def ),
- SUB_LONG( a->minimum, a->def ) );
- else if ( coord > a->def )
- normalized[i] = FT_DivFix( SUB_LONG( coord, a->def ),
+ if ( coord > a->def )
+ normalized[i] = coord >= a->maximum ? 0x10000L :
+ FT_DivFix( SUB_LONG( coord, a->def ),
SUB_LONG( a->maximum, a->def ) );
+ else if ( coord < a->def )
+ normalized[i] = coord <= a->minimum ? -0x10000L :
+ FT_DivFix( SUB_LONG( coord, a->def ),
+ SUB_LONG( a->def, a->minimum ) );
else
normalized[i] = 0;
}
@@ -3164,6 +3233,8 @@
/*************************************************************************/
+#ifdef TT_CONFIG_OPTION_BYTECODE_INTERPRETER
+
static FT_Error
tt_cvt_ready_iterator( FT_ListNode node,
void* user )
@@ -3178,6 +3249,9 @@
return FT_Err_Ok;
}
+#endif /* TT_CONFIG_OPTION_BYTECODE_INTERPRETER */
+
+
/**************************************************************************
*
@@ -3206,6 +3280,8 @@
tt_face_vary_cvt( TT_Face face,
FT_Stream stream )
{
+#ifdef TT_CONFIG_OPTION_BYTECODE_INTERPRETER
+
FT_Error error;
FT_Memory memory = stream->memory;
@@ -3409,9 +3485,7 @@
point_count == 0 ? face->cvt_size
: point_count );
- if ( !points ||
- !deltas ||
- ( localpoints == ALL_POINTS && point_count != face->cvt_size ) )
+ if ( !points || !deltas )
; /* failure, ignore it */
else if ( localpoints == ALL_POINTS )
@@ -3526,6 +3600,16 @@
NULL );
return error;
+
+#else /* !TT_CONFIG_OPTION_BYTECODE_INTERPRETER */
+
+ FT_UNUSED( face );
+ FT_UNUSED( stream );
+
+ return FT_Err_Ok;
+
+#endif /* !TT_CONFIG_OPTION_BYTECODE_INTERPRETER */
+
}