Update bundled freetype to 2.6.1

third_party/freetype/src/base/ftrfork.c

 /***************************************************************************/
 /*                                                                         */
 /*  ftrfork.c                                                              */
 /*                                                                         */
 /*    Embedded resource forks accessor (body).                             */
 /*                                                                         */
-/*  Copyright 2004-2010, 2013, 2014 by                                     */
+/*  Copyright 2004-2015 by                                                 */
 /*  Masatake YAMATO and Redhat K.K.                                        */
 /*                                                                         */
 /*  FT_Raccess_Get_HeaderInfo() and raccess_guess_darwin_hfsplus() are     */
 /*  derived from ftobjs.c.                                                 */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
@@ skipping 38 matching lines @@
   {
     FT_Error       error;
     unsigned char  head[16], head2[16];
     FT_Long        map_pos, rdata_len;
     int            allzeros, allmatch, i;
     FT_Long        type_list;
 
     FT_UNUSED( library );
 
 
-    error = FT_Stream_Seek( stream, rfork_offset );
+    error = FT_Stream_Seek( stream, (FT_ULong)rfork_offset );
     if ( error )
       return error;
 
     error = FT_Stream_Read( stream, (FT_Byte *)head, 16 );
     if ( error )
       return error;
 
-    *rdata_pos = rfork_offset + ( ( head[0] << 24 ) |
-                                  ( head[1] << 16 ) |
-                                  ( head[2] <<  8 ) |
-                                    head[3]         );
-    map_pos    = rfork_offset + ( ( head[4] << 24 ) |
-                                  ( head[5] << 16 ) |
-                                  ( head[6] <<  8 ) |
-                                    head[7]         );
-    rdata_len = ( head[ 8] << 24 ) |
-                ( head[ 9] << 16 ) |
-                ( head[10] <<  8 ) |
-                  head[11];
+    /* ensure positive values */
+    if ( head[0] >= 0x80 || head[4] >= 0x80 || head[8] >= 0x80 )
+      return FT_THROW( Unknown_File_Format );
+
+    *rdata_pos = ( head[ 0] << 24 ) |
+                 ( head[ 1] << 16 ) |
+                 ( head[ 2] <<  8 ) |
+                   head[ 3];
+    map_pos    = ( head[ 4] << 24 ) |
+                 ( head[ 5] << 16 ) |
+                 ( head[ 6] <<  8 ) |
+                   head[ 7];
+    rdata_len  = ( head[ 8] << 24 ) |
+                 ( head[ 9] << 16 ) |
+                 ( head[10] <<  8 ) |
+                   head[11];
 
     /* map_len = head[12] .. head[15] */
 
-    if ( *rdata_pos + rdata_len != map_pos || map_pos == rfork_offset )
+    if ( *rdata_pos != map_pos - rdata_len || map_pos == 0 )
       return FT_THROW( Unknown_File_Format );
 
-    error = FT_Stream_Seek( stream, map_pos );
+    if ( FT_LONG_MAX - rfork_offset < *rdata_pos ||
+         FT_LONG_MAX - rfork_offset < map_pos    )
+      return FT_THROW( Unknown_File_Format );
+
+    *rdata_pos += rfork_offset;
+    map_pos    += rfork_offset;
+
+    error = FT_Stream_Seek( stream, (FT_ULong)map_pos );
     if ( error )
       return error;
 
     head2[15] = (FT_Byte)( head[15] + 1 );       /* make it be different */
 
     error = FT_Stream_Read( stream, (FT_Byte*)head2, 16 );
     if ( error )
       return error;
 
     allzeros = 1;
@@ skipping 14 matching lines @@
     /* attributes.                                                      */
     (void)FT_STREAM_SKIP( 4        /* skip handle to next resource map */
                           + 2      /* skip file resource number */
                           + 2 );   /* skip attributes */
 
     if ( FT_READ_USHORT( type_list ) )
       return error;
     if ( type_list == -1 )
       return FT_THROW( Unknown_File_Format );
 
-    error = FT_Stream_Seek( stream, map_pos + type_list );
+    error = FT_Stream_Seek( stream, (FT_ULong)( map_pos + type_list ) );
     if ( error )
       return error;
 
     *map_offset = map_pos + type_list;
     return FT_Err_Ok;
   }
 
 
   static int
   ft_raccess_sort_ref_by_id( FT_RFork_Ref*  a,
@@ skipping 21 matching lines @@
     FT_Error      error;
     int           i, j, cnt, subcnt;
     FT_Long       tag_internal, rpos;
     FT_Memory     memory = library->memory;
     FT_Long       temp;
     FT_Long       *offsets_internal = NULL;
     FT_RFork_Ref  *ref = NULL;
 
 
     FT_TRACE3(( "\n" ));
-    error = FT_Stream_Seek( stream, map_offset );
+    error = FT_Stream_Seek( stream, (FT_ULong)map_offset );
     if ( error )
       return error;
 
     if ( FT_READ_USHORT( cnt ) )
       return error;
     cnt++;
 
     for ( i = 0; i < cnt; ++i )
     {
       if ( FT_READ_LONG( tag_internal ) ||
            FT_READ_USHORT( subcnt )     ||
            FT_READ_USHORT( rpos )       )
         return error;
 
       FT_TRACE2(( "Resource tags: %c%c%c%c\n",
-                  (char)( 0xff & ( tag_internal >> 24 ) ),
-                  (char)( 0xff & ( tag_internal >> 16 ) ),
-                  (char)( 0xff & ( tag_internal >>  8 ) ),
-                  (char)( 0xff & ( tag_internal >>  0 ) ) ));
+                  (char)( 0xFF & ( tag_internal >> 24 ) ),
+                  (char)( 0xFF & ( tag_internal >> 16 ) ),
+                  (char)( 0xFF & ( tag_internal >>  8 ) ),
+                  (char)( 0xFF & ( tag_internal >>  0 ) ) ));
       FT_TRACE3(( "             : subcount=%d, suboffset=0x%04x\n",
                   subcnt, rpos ));
 
       if ( tag_internal == tag )
       {
         *count = subcnt + 1;
         rpos  += map_offset;
 
-        error = FT_Stream_Seek( stream, rpos );
+        error = FT_Stream_Seek( stream, (FT_ULong)rpos );
         if ( error )
           return error;
 
         if ( FT_NEW_ARRAY( ref, *count ) )
           return error;
 
         for ( j = 0; j < *count; ++j )
         {
           if ( FT_READ_USHORT( ref[j].res_id ) )
             goto Exit;
           if ( FT_STREAM_SKIP( 2 ) ) /* resource name */
             goto Exit;
           if ( FT_READ_LONG( temp ) )
             goto Exit;
           if ( FT_STREAM_SKIP( 4 ) ) /* mbz */
             goto Exit;
 
           ref[j].offset = temp & 0xFFFFFFL;
           FT_TRACE3(( "             [%d]:"
                       " resource_id=0x%04x, offset=0x%08x\n",
                       j, ref[j].res_id, ref[j].offset ));
         }
 
         if (sort_by_res_id)
         {
-          ft_qsort( ref, *count, sizeof ( FT_RFork_Ref ),
+          ft_qsort( ref, (size_t)*count, sizeof ( FT_RFork_Ref ),
                     ( int(*)(const void*, const void*) )
                     ft_raccess_sort_ref_by_id );
 
           FT_TRACE3(( "             -- sort resources by their ids --\n" ));
           for ( j = 0; j < *count; ++ j ) {
             FT_TRACE3(( "             [%d]:"
                         " resource_id=0x%04x, offset=0x%08x\n",
                         j, ref[j].res_id, ref[j].offset ));
           }
         }
@@ skipping 472 matching lines @@
                                char       *base_file_name,
                                FT_Int32    magic,
                                FT_Long    *result_offset )
   {
     FT_Int32   magic_from_stream;
     FT_Error   error;
     FT_Int32   version_number = 0;
     FT_UShort  n_of_entries;
 
     int        i;
-    FT_UInt32  entry_id, entry_offset, entry_length = 0;
+    FT_Int32   entry_id, entry_offset, entry_length = 0;
 
-    const FT_UInt32  resource_fork_entry_id = 0x2;
+    const FT_Int32  resource_fork_entry_id = 0x2;
 
     FT_UNUSED( library );
     FT_UNUSED( base_file_name );
     FT_UNUSED( version_number );
     FT_UNUSED( entry_length   );
 
 
     if ( FT_READ_LONG( magic_from_stream ) )
       return error;
     if ( magic_from_stream != magic )
@@ skipping 77 matching lines @@
     FT_UNUSED( error );
 
 
     new_length = ft_strlen( original_name ) + ft_strlen( insertion );
     if ( FT_ALLOC( new_name, new_length + 1 ) )
       return NULL;
 
     tmp = ft_strrchr( original_name, '/' );
     if ( tmp )
     {
-      ft_strncpy( new_name, original_name, tmp - original_name + 1 );
+      ft_strncpy( new_name,
+                  original_name,
+                  (size_t)( tmp - original_name + 1 ) );
       new_name[tmp - original_name + 1] = '\0';
       slash = tmp + 1;
     }
     else
     {
       slash       = original_name;
       new_name[0] = '\0';
     }
 
     ft_strcat( new_name, insertion );
@@ skipping 31 matching lines @@
       offsets[i]   = 0;
       errors[i]    = FT_ERR( Unimplemented_Feature );
     }
   }
 
 
 #endif  /* !FT_CONFIG_OPTION_GUESSING_EMBEDDED_RFORK */
 
 
 /* END */