Update bundled freetype to 2.6.1

third_party/freetype/src/base/ftmac.c

 /***************************************************************************/
 /*                                                                         */
 /*  ftmac.c                                                                */
 /*                                                                         */
 /*    Mac FOND support.  Written by just@letterror.com.                    */
 /*  Heavily modified by mpsuzuki, George Williams, and Sean McBride.       */
 /*                                                                         */
 /*  This file is for Mac OS X only; see builds/mac/ftoldmac.c for          */
 /*  classic platforms built by MPW.                                        */
 /*                                                                         */
-/*  Copyright 1996-2009, 2013, 2014 by                                     */
+/*  Copyright 1996-2015 by                                                 */
 /*  Just van Rossum, David Turner, Robert Wilhelm, and Werner Lemberg.     */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
@@ skipping 589 matching lines @@
       code = (*post_data)[0];
 
       if ( code != last_code )
       {
         if ( code == 5 )
           total_size += 2; /* just the end code */
         else
           total_size += 6; /* code + 4 bytes chunk length */
       }
 
-      total_size += GetHandleSize( post_data ) - 2;
+      total_size += (FT_ULong)GetHandleSize( post_data ) - 2;
       last_code = code;
 
-      /* detect integer overflows */
-      if ( total_size < old_total_size )
+      /* detect resource fork overflow */
+      if ( FT_MAC_RFORK_MAX_LEN < total_size )
       {
         error = FT_THROW( Array_Too_Large );
         goto Error;
       }
 
       old_total_size = total_size;
     }
 
     if ( FT_ALLOC( buffer, (FT_Long)total_size ) )
       goto Error;
@@ skipping 104 matching lines @@
     FT_Error   error  = FT_Err_Ok;
     FT_Memory  memory = library->memory;
     int        is_cff, is_sfnt_ps;
 
 
     sfnt = GetResource( TTAG_sfnt, sfnt_id );
     if ( sfnt == NULL )
       return FT_THROW( Invalid_Handle );
 
     sfnt_size = (FT_ULong)GetHandleSize( sfnt );
+
+    /* detect resource fork overflow */
+    if ( FT_MAC_RFORK_MAX_LEN < sfnt_size )
+      return FT_THROW( Array_Too_Large );
+
     if ( FT_ALLOC( sfnt_data, (FT_Long)sfnt_size ) )
     {
       ReleaseResource( sfnt );
       return error;
     }
 
     ft_memcpy( sfnt_data, *sfnt, sfnt_size );
     ReleaseResource( sfnt );
 
     is_cff     = sfnt_size > 4 && !ft_memcmp( sfnt_data, "OTTO", 4 );
@@ skipping 306 matching lines @@
       return FT_THROW( Invalid_Argument );
     else
       return FT_New_Face_From_FSRef( library, &ref, face_index, aface );
 #endif
   }
 
 #endif /* FT_MACINTOSH */
 
 
 /* END */