Update bundled freetype to 2.6.1

third_party/freetype/src/cff/cffparse.c

 /***************************************************************************/
 /*                                                                         */
 /*  cffparse.c                                                             */
 /*                                                                         */
 /*    CFF token stream parser (body)                                       */
 /*                                                                         */
-/*  Copyright 1996-2004, 2007-2014 by                                      */
+/*  Copyright 1996-2015 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
@@ skipping 104 matching lines @@
 
 
   /* read a real */
   static FT_Fixed
   cff_parse_real( FT_Byte*  start,
                   FT_Byte*  limit,
                   FT_Long   power_ten,
                   FT_Long*  scaling )
   {
     FT_Byte*  p = start;
-    FT_UInt   nib;
+    FT_Int    nib;
     FT_UInt   phase;
 
     FT_Long   result, number, exponent;
     FT_Int    sign = 0, exponent_sign = 0, have_overflow = 0;
     FT_Long   exponent_add, integer_length, fraction_length;
 
 
     if ( scaling )
       *scaling = 0;
 
@@ skipping 16 matching lines @@
       if ( phase )
       {
         p++;
 
         /* Make sure we don't read past the end. */
         if ( p >= limit )
           goto Bad;
       }
 
       /* Get the nibble. */
-      nib   = ( p[0] >> phase ) & 0xF;
+      nib   = (FT_Int)( p[0] >> phase ) & 0xF;
       phase = 4 - phase;
 
       if ( nib == 0xE )
         sign = 1;
       else if ( nib > 9 )
         break;
       else
       {
         /* Increase exponent if we can't add the digit. */
         if ( number >= 0xCCCCCCCL )
           exponent_add++;
         /* Skip leading zeros. */
         else if ( nib || number )
         {
           integer_length++;
           number = number * 10 + nib;
         }
       }
     }
 
     /* Read fraction part, if any. */
-    if ( nib == 0xa )
+    if ( nib == 0xA )
       for (;;)
       {
         /* If we entered this iteration with phase == 4, we need */
         /* to read a new byte.                                   */
         if ( phase )
         {
           p++;
 
           /* Make sure we don't read past the end. */
           if ( p >= limit )
@@ skipping 350 matching lines @@
 
         goto Exit;
       }
 
       matrix->yx = cff_parse_fixed_scaled( data++, scaling );
       matrix->xy = cff_parse_fixed_scaled( data++, scaling );
       matrix->yy = cff_parse_fixed_scaled( data++, scaling );
       offset->x  = cff_parse_fixed_scaled( data++, scaling );
       offset->y  = cff_parse_fixed_scaled( data,   scaling );
 
-      *upm = power_tens[scaling];
+      *upm = (FT_ULong)power_tens[scaling];
 
       FT_TRACE4(( " [%f %f %f %f %f %f]\n",
                   (double)matrix->xx / *upm / 65536,
                   (double)matrix->xy / *upm / 65536,
                   (double)matrix->yx / *upm / 65536,
                   (double)matrix->yy / *upm / 65536,
                   (double)offset->x  / *upm / 65536,
                   (double)offset->y  / *upm / 65536 ));
     }
 
@@ skipping 37 matching lines @@
   {
     CFF_FontRecDict  dict = (CFF_FontRecDict)parser->object;
     FT_Byte**        data = parser->stack;
     FT_Error         error;
 
 
     error = FT_ERR( Stack_Underflow );
 
     if ( parser->top >= parser->stack + 2 )
     {
-      dict->private_size   = cff_parse_num( data++ );
-      dict->private_offset = cff_parse_num( data   );
+      FT_Long  tmp;
+
+
+      tmp = cff_parse_num( data++ );
+      if ( tmp < 0 )
+      {
+        FT_ERROR(( "cff_parse_private_dict: Invalid dictionary size\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Fail;
+      }
+      dict->private_size = (FT_ULong)tmp;
+
+      tmp = cff_parse_num( data );
+      if ( tmp < 0 )
+      {
+        FT_ERROR(( "cff_parse_private_dict: Invalid dictionary offset\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Fail;
+      }
+      dict->private_offset = (FT_ULong)tmp;
+
       FT_TRACE4(( " %lu %lu\n",
                   dict->private_size, dict->private_offset ));
 
       error = FT_Err_Ok;
     }
 
+  Fail:
     return error;
   }
 
 
   static FT_Error
   cff_parse_cid_ros( CFF_Parser  parser )
   {
     CFF_FontRecDict  dict = (CFF_FontRecDict)parser->object;
     FT_Byte**        data = parser->stack;
     FT_Error         error;
@@ skipping 526 matching lines @@
     error = FT_THROW( Invalid_Argument );
     goto Exit;
 
   Syntax_Error:
     error = FT_THROW( Invalid_Argument );
     goto Exit;
   }
 
 
 /* END */