Update bundled freetype to 2.6.1

third_party/freetype/src/sfnt/ttcmap.c

 /***************************************************************************/
 /*                                                                         */
 /*  ttcmap.c                                                               */
 /*                                                                         */
 /*    TrueType character mapping table (cmap) support (body).              */
 /*                                                                         */
-/*  Copyright 2002-2010, 2012-2014 by                                      */
+/*  Copyright 2002-2015 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
@@ skipping 26 matching lines @@
 #define TT_PEEK_LONG    FT_PEEK_LONG
 #define TT_PEEK_ULONG   FT_PEEK_ULONG
 
 #define TT_NEXT_SHORT   FT_NEXT_SHORT
 #define TT_NEXT_USHORT  FT_NEXT_USHORT
 #define TT_NEXT_UINT24  FT_NEXT_UOFF3
 #define TT_NEXT_LONG    FT_NEXT_LONG
 #define TT_NEXT_ULONG   FT_NEXT_ULONG
 
 
+  /* Too large glyph index return values are caught in `FT_Get_Char_Index' */
+  /* and `FT_Get_Next_Char' (the latter calls the internal `next' function */
+  /* again in this case).  To mark character code return values as invalid */
+  /* it is sufficient to set the corresponding glyph index return value to */
+  /* zero.                                                                 */
+
+
   FT_CALLBACK_DEF( FT_Error )
   tt_cmap_init( TT_CMap   cmap,
                 FT_Byte*  table )
   {
     cmap->data = table;
     return FT_Err_Ok;
   }
 
 
   /*************************************************************************/
@@ skipping 128 matching lines @@
 
 #endif /* TT_CONFIG_CMAP_FORMAT_0 */
 
 
   /*************************************************************************/
   /*************************************************************************/
   /*****                                                               *****/
   /*****                          FORMAT 2                             *****/
   /*****                                                               *****/
   /***** This is used for certain CJK encodings that encode text in a  *****/
-  /***** mixed 8/16 bits encoding along the following lines:           *****/
+  /***** mixed 8/16 bits encoding along the following lines.           *****/
   /*****                                                               *****/
   /***** * Certain byte values correspond to an 8-bit character code   *****/
   /*****   (typically in the range 0..127 for ASCII compatibility).    *****/
   /*****                                                               *****/
   /***** * Certain byte values signal the first byte of a 2-byte       *****/
   /*****   character code (but these values are also valid as the      *****/
   /*****   second byte of a 2-byte character).                         *****/
   /*****                                                               *****/
   /***** The following charmap lookup and iteration functions all      *****/
-  /***** assume that the value "charcode" correspond to following:     *****/
+  /***** assume that the value `charcode' fulfills the following.      *****/
   /*****                                                               *****/
-  /*****   - For one byte characters, "charcode" is simply the         *****/
+  /*****   - For one byte characters, `charcode' is simply the         *****/
   /*****     character code.                                           *****/
   /*****                                                               *****/
-  /*****   - For two byte characters, "charcode" is the 2-byte         *****/
-  /*****     character code in big endian format.  More exactly:       *****/
+  /*****   - For two byte characters, `charcode' is the 2-byte         *****/
+  /*****     character code in big endian format.  More precisely:     *****/
   /*****                                                               *****/
   /*****       (charcode >> 8)    is the first byte value              *****/
   /*****       (charcode & 0xFF)  is the second byte value             *****/
   /*****                                                               *****/
-  /***** Note that not all values of "charcode" are valid according    *****/
-  /***** to these rules, and the function moderately check the         *****/
+  /***** Note that not all values of `charcode' are valid according    *****/
+  /***** to these rules, and the function moderately checks the        *****/
   /***** arguments.                                                    *****/
   /*****                                                               *****/
   /*************************************************************************/
   /*************************************************************************/
 
   /*************************************************************************/
   /*                                                                       */
   /* TABLE OVERVIEW                                                        */
   /* --------------                                                        */
   /*                                                                       */
   /*   NAME        OFFSET         TYPE            DESCRIPTION              */
   /*                                                                       */
   /*   format      0              USHORT          must be 2                */
   /*   length      2              USHORT          table length in bytes    */
   /*   language    4              USHORT          Mac language code        */
   /*   keys        6              USHORT[256]     sub-header keys          */
   /*   subs        518            SUBHEAD[NSUBS]  sub-headers array        */
   /*   glyph_ids   518+NSUB*8     USHORT[]        glyph ID array           */
   /*                                                                       */
   /* The `keys' table is used to map charcode high-bytes to sub-headers.   */
   /* The value of `NSUBS' is the number of sub-headers defined in the      */
   /* table and is computed by finding the maximum of the `keys' table.     */
   /*                                                                       */
   /* Note that for any n, `keys[n]' is a byte offset within the `subs'     */
   /* table, i.e., it is the corresponding sub-header index multiplied      */
   /* by 8.                                                                 */
   /*                                                                       */
-  /* Each sub-header has the following format:                             */
+  /* Each sub-header has the following format.                             */
   /*                                                                       */
   /*   NAME        OFFSET      TYPE            DESCRIPTION                 */
   /*                                                                       */
   /*   first       0           USHORT          first valid low-byte        */
   /*   count       2           USHORT          number of valid low-bytes   */
   /*   delta       4           SHORT           see below                   */
   /*   offset      6           USHORT          see below                   */
   /*                                                                       */
   /* A sub-header defines, for each high-byte, the range of valid          */
   /* low-bytes within the charmap.  Note that the range defined by `first' */
   /* and `count' must be completely included in the interval [0..255]      */
   /* according to the specification.                                       */
   /*                                                                       */
   /* If a character code is contained within a given sub-header, then      */
-  /* mapping it to a glyph index is done as follows:                       */
+  /* mapping it to a glyph index is done as follows.                       */
   /*                                                                       */
   /* * The value of `offset' is read.  This is a _byte_ distance from the  */
   /*   location of the `offset' field itself into a slice of the           */
-  /*   `glyph_ids' table.  Let's call it `slice' (it is a USHORT[] too).   */
+  /*   `glyph_ids' table.  Let's call it `slice' (it is a USHORT[], too).  */
   /*                                                                       */
   /* * The value `slice[char.lo - first]' is read.  If it is 0, there is   */
   /*   no glyph for the charcode.  Otherwise, the value of `delta' is      */
   /*   added to it (modulo 65536) to form a new glyph index.               */
   /*                                                                       */
   /* It is up to the validation routine to check that all offsets fall     */
   /* within the glyph IDs table (and not within the `subs' table itself or */
   /* outside of the CMap).                                                 */
   /*                                                                       */
 
@@ skipping 37 matching lines @@
 
       idx >>= 3;
 
       if ( idx > max_subs )
         max_subs = idx;
     }
 
     FT_ASSERT( p == table + 518 );
 
     subs      = p;
-    glyph_ids = subs + (max_subs + 1) * 8;
+    glyph_ids = subs + ( max_subs + 1 ) * 8;
     if ( glyph_ids > valid->limit )
       FT_INVALID_TOO_SHORT;
 
     /* parse sub-headers */
     for ( n = 0; n <= max_subs; n++ )
     {
       FT_UInt  first_code, code_count, offset;
       FT_Int   delta;
 
 
@@ skipping 13 matching lines @@
           FT_INVALID_DATA;
       }
 
       /* check offset */
       if ( offset != 0 )
       {
         FT_Byte*  ids;
 
 
         ids = p - 2 + offset;
-        if ( ids < glyph_ids || ids + code_count*2 > table + length )
+        if ( ids < glyph_ids || ids + code_count * 2 > table + length )
           FT_INVALID_OFFSET;
 
         /* check glyph IDs */
         if ( valid->level >= FT_VALIDATE_TIGHT )
         {
           FT_Byte*  limit = p + code_count * 2;
           FT_UInt   idx;
 
 
           for ( ; p < limit; )
           {
             idx = TT_NEXT_USHORT( p );
             if ( idx != 0 )
             {
-              idx = ( idx + delta ) & 0xFFFFU;
+              idx = (FT_UInt)( (FT_Int)idx + delta ) & 0xFFFFU;
               if ( idx >= TT_VALID_GLYPH_COUNT( valid ) )
                 FT_INVALID_GLYPH_ID;
             }
           }
         }
       }
     }
 
     return FT_Err_Ok;
   }
@@ skipping 40 matching lines @@
         p  += char_hi * 2;
         /* jump to sub-header */
         sub = subs + ( FT_PAD_FLOOR( TT_PEEK_USHORT( p ), 8 ) );
 
         /* check that the high byte isn't a valid one-byte value */
         if ( sub == subs )
           goto Exit;
       }
       result = sub;
     }
+
   Exit:
     return result;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt )
   tt_cmap2_char_index( TT_CMap    cmap,
                        FT_UInt32  char_code )
   {
     FT_Byte*  table   = cmap->data;
@@ skipping 16 matching lines @@
       delta  = TT_NEXT_SHORT ( p );
       offset = TT_PEEK_USHORT( p );
 
       idx -= start;
       if ( idx < count && offset != 0 )
       {
         p  += offset + 2 * idx;
         idx = TT_PEEK_USHORT( p );
 
         if ( idx != 0 )
-          result = (FT_UInt)( idx + delta ) & 0xFFFFU;
+          result = (FT_UInt)( (FT_Int)idx + delta ) & 0xFFFFU;
       }
     }
+
     return result;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap2_char_next( TT_CMap     cmap,
                       FT_UInt32  *pcharcode )
   {
     FT_Byte*   table    = cmap->data;
     FT_UInt    gindex   = 0;
@@ skipping 29 matching lines @@
 
         p       += offset + pos * 2;
         charcode = FT_PAD_FLOOR( charcode, 256 ) + char_lo;
 
         for ( ; pos < count; pos++, charcode++ )
         {
           idx = TT_NEXT_USHORT( p );
 
           if ( idx != 0 )
           {
-            gindex = ( idx + delta ) & 0xFFFFU;
+            gindex = (FT_UInt)( (FT_Int)idx + delta ) & 0xFFFFU;
             if ( gindex != 0 )
             {
               result = charcode;
               goto Exit;
             }
           }
         }
       }
 
       /* jump to next sub-header, i.e. higher byte value */
@@ skipping 241 matching lines @@
           FT_Byte*  p = values + 2 * ( charcode - cmap->cur_start );
 
 
           do
           {
             FT_UInt  gindex = FT_NEXT_USHORT( p );
 
 
             if ( gindex != 0 )
             {
-              gindex = (FT_UInt)( ( gindex + delta ) & 0xFFFFU );
+              gindex = (FT_UInt)( (FT_Int)gindex + delta ) & 0xFFFFU;
               if ( gindex != 0 )
               {
                 cmap->cur_charcode = charcode;
                 cmap->cur_gindex   = gindex;
                 return;
               }
             }
           } while ( ++charcode <= end );
         }
         else
         {
           do
           {
-            FT_UInt  gindex = (FT_UInt)( ( charcode + delta ) & 0xFFFFU );
+            FT_UInt  gindex = (FT_UInt)( (FT_Int)charcode + delta ) & 0xFFFFU;
 
 
             if ( gindex != 0 )
             {
               cmap->cur_charcode = charcode;
               cmap->cur_gindex   = gindex;
               return;
             }
           } while ( ++charcode <= end );
         }
@@ skipping 152 matching lines @@
           }
           /* Some fonts handle the last segment incorrectly.  In */
           /* theory, 0xFFFF might point to an ordinary glyph --  */
           /* a cmap 4 is versatile and could be used for any     */
           /* encoding, not only Unicode.  However, reality shows */
           /* that far too many fonts are sloppy and incorrectly  */
           /* set all fields but `start' and `end' for the last   */
           /* segment if it contains only a single character.     */
           /*                                                     */
           /* We thus omit the test here, delaying it to the      */
-          /* routines which actually access the cmap.            */
+          /* routines that actually access the cmap.             */
           else if ( n != num_segs - 1                       ||
                     !( start == 0xFFFFU && end == 0xFFFFU ) )
           {
             if ( p < glyph_ids                              ||
                  p + ( end - start + 1 ) * 2 > valid->limit )
               FT_INVALID_DATA;
           }
 
           /* check glyph indices within the segment range */
           if ( valid->level >= FT_VALIDATE_TIGHT )
           {
             FT_UInt  i, idx;
 
 
             for ( i = start; i < end; i++ )
             {
               idx = FT_NEXT_USHORT( p );
               if ( idx != 0 )
               {
-                idx = (FT_UInt)( idx + delta ) & 0xFFFFU;
+                idx = (FT_UInt)( (FT_Int)idx + delta ) & 0xFFFFU;
 
                 if ( idx >= TT_VALID_GLYPH_COUNT( valid ) )
                   FT_INVALID_GLYPH_ID;
               }
             }
           }
         }
         else if ( offset == 0xFFFFU )
         {
           /* some fonts (erroneously?) use a range offset of 0xFFFF */
@@ skipping 12 matching lines @@
 
     return error;
   }
 
 
   static FT_UInt
   tt_cmap4_char_map_linear( TT_CMap     cmap,
                             FT_UInt32*  pcharcode,
                             FT_Bool     next )
   {
+    TT_Face   face  = (TT_Face)cmap->cmap.charmap.face;
+    FT_Byte*  limit = face->cmap_table + face->cmap_size;
+
+
     FT_UInt    num_segs2, start, end, offset;
     FT_Int     delta;
     FT_UInt    i, num_segs;
     FT_UInt32  charcode = *pcharcode;
     FT_UInt    gindex   = 0;
     FT_Byte*   p;
+    FT_Byte*   q;
 
 
     p = cmap->data + 6;
     num_segs2 = FT_PAD_FLOOR( TT_PEEK_USHORT( p ), 2 );
 
     num_segs = num_segs2 >> 1;
 
     if ( !num_segs )
       return 0;
 
     if ( next )
       charcode++;
 
+    if ( charcode > 0xFFFFU )
+      return 0;
+
     /* linear search */
-    for ( ; charcode <= 0xFFFFU; charcode++ )
+    p = cmap->data + 14;               /* ends table   */
+    q = cmap->data + 16 + num_segs2;   /* starts table */
+
+    for ( i = 0; i < num_segs; i++ )
     {
-      FT_Byte*  q;
+      end   = TT_NEXT_USHORT( p );
+      start = TT_NEXT_USHORT( q );
+
+      if ( charcode < start )
+      {
+        if ( next )
+          charcode = start;
+        else
+          break;
+      }
+
+    Again:
+      if ( charcode <= end )
+      {
+        FT_Byte*  r;
 
 
-      p = cmap->data + 14;               /* ends table   */
-      q = cmap->data + 16 + num_segs2;   /* starts table */
+        r       = q - 2 + num_segs2;
+        delta   = TT_PEEK_SHORT( r );
+        r      += num_segs2;
+        offset  = TT_PEEK_USHORT( r );
 
-      for ( i = 0; i < num_segs; i++ )
-      {
-        end   = TT_NEXT_USHORT( p );
-        start = TT_NEXT_USHORT( q );
+        /* some fonts have an incorrect last segment; */
+        /* we have to catch it                        */
+        if ( i >= num_segs - 1                  &&
+             start == 0xFFFFU && end == 0xFFFFU )
+        {
+          if ( offset && r + offset + 2 > limit )
+          {
+            delta  = 1;
+            offset = 0;
+          }
+        }
 
-        if ( charcode >= start && charcode <= end )
+        if ( offset == 0xFFFFU )
+          continue;
+
+        if ( offset )
         {
-          p       = q - 2 + num_segs2;
-          delta   = TT_PEEK_SHORT( p );
-          p      += num_segs2;
-          offset  = TT_PEEK_USHORT( p );
+          r += offset + ( charcode - start ) * 2;
 
-          /* some fonts have an incorrect last segment; */
-          /* we have to catch it                        */
-          if ( i >= num_segs - 1                  &&
-               start == 0xFFFFU && end == 0xFFFFU )
-          {
-            TT_Face   face  = (TT_Face)cmap->cmap.charmap.face;
-            FT_Byte*  limit = face->cmap_table + face->cmap_size;
-
-
-            if ( offset && p + offset + 2 > limit )
-            {
-              delta  = 1;
-              offset = 0;
-            }
-          }
-
-          if ( offset == 0xFFFFU )
+          /* if r > limit, the whole segment is invalid */
+          if ( next && r > limit )
             continue;
 
-          if ( offset )
+          gindex = TT_PEEK_USHORT( r );
+          if ( gindex )
           {
-            p += offset + ( charcode - start ) * 2;
-            gindex = TT_PEEK_USHORT( p );
-            if ( gindex != 0 )
-              gindex = (FT_UInt)( gindex + delta ) & 0xFFFFU;
+            gindex = (FT_UInt)( (FT_Int)gindex + delta ) & 0xFFFFU;
+            if ( gindex >= (FT_UInt)face->root.num_glyphs )
+              gindex = 0;
           }
-          else
-            gindex = (FT_UInt)( charcode + delta ) & 0xFFFFU;
+        }
+        else
+        {
+          gindex = (FT_UInt)( (FT_Int)charcode + delta ) & 0xFFFFU;
 
-          break;
+          if ( next && gindex >= (FT_UInt)face->root.num_glyphs )
+          {
+            /* we have an invalid glyph index; if there is an overflow, */
+            /* we can adjust `charcode', otherwise the whole segment is */
+            /* invalid                                                  */
+            gindex = 0;
+
+            if ( (FT_Int)charcode + delta < 0 &&
+                 (FT_Int)end + delta >= 0     )
+              charcode = (FT_UInt)( -delta );
+
+            else if ( (FT_Int)charcode + delta < 0x10000L &&
+                      (FT_Int)end + delta >= 0x10000L     )
+              charcode = (FT_UInt)( 0x10000L - delta );
+
+            else
+              continue;
+          }
         }
+
+        if ( next && !gindex )
+        {
+          if ( charcode >= 0xFFFFU )
+            break;
+
+          charcode++;
+          goto Again;
+        }
+
+        break;
       }
-
-      if ( !next || gindex )
-        break;
     }
 
-    if ( next && gindex )
+    if ( next )
       *pcharcode = charcode;
 
     return gindex;
   }
 
 
   static FT_UInt
   tt_cmap4_char_map_binary( TT_CMap     cmap,
                             FT_UInt32*  pcharcode,
                             FT_Bool     next )
@@ skipping 170 matching lines @@
         {
           if ( offset == 0xFFFFU )
             break;
         }
 
         if ( offset )
         {
           p += offset + ( charcode - start ) * 2;
           gindex = TT_PEEK_USHORT( p );
           if ( gindex != 0 )
-            gindex = (FT_UInt)( gindex + delta ) & 0xFFFFU;
+            gindex = (FT_UInt)( (FT_Int)gindex + delta ) & 0xFFFFU;
         }
         else
-          gindex = (FT_UInt)( charcode + delta ) & 0xFFFFU;
+          gindex = (FT_UInt)( (FT_Int)charcode + delta ) & 0xFFFFU;
 
         break;
       }
     }
 
     if ( next )
     {
       TT_CMap4  cmap4 = (TT_CMap4)cmap;
 
 
       /* if `charcode' is not in any segment, then `mid' is */
       /* the segment nearest to `charcode'                  */
-      /*                                                    */
 
       if ( charcode > end )
       {
         mid++;
         if ( mid == num_segs )
           return 0;
       }
 
       if ( tt_cmap4_set_range( cmap4, mid ) )
       {
@@ skipping 112 matching lines @@
   /*************************************************************************/
   /*************************************************************************/
 
   /*************************************************************************/
   /*                                                                       */
   /* TABLE OVERVIEW                                                        */
   /* --------------                                                        */
   /*                                                                       */
   /*   NAME        OFFSET          TYPE             DESCRIPTION            */
   /*                                                                       */
-  /*   format       0              USHORT           must be 4              */
+  /*   format       0              USHORT           must be 6              */
   /*   length       2              USHORT           table length in bytes  */
   /*   language     4              USHORT           Mac language code      */
   /*                                                                       */
   /*   first        6              USHORT           first segment code     */
   /*   count        8              USHORT           segment size in chars  */
   /*   glyphIds     10             USHORT[count]    glyph IDs              */
   /*                                                                       */
   /* A very simplified segment mapping.                                    */
   /*                                                                       */
 
@@ skipping 47 matching lines @@
     FT_UInt   start  = TT_NEXT_USHORT( p );
     FT_UInt   count  = TT_NEXT_USHORT( p );
     FT_UInt   idx    = (FT_UInt)( char_code - start );
 
 
     if ( idx < count )
     {
       p += 2 * idx;
       result = TT_PEEK_USHORT( p );
     }
+
     return result;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap6_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
     FT_Byte*   table     = cmap->data;
     FT_UInt32  result    = 0;
     FT_UInt32  char_code = *pchar_code + 1;
     FT_UInt    gindex    = 0;
 
     FT_Byte*   p         = table + 6;
     FT_UInt    start     = TT_NEXT_USHORT( p );
     FT_UInt    count     = TT_NEXT_USHORT( p );
     FT_UInt    idx;
 
 
     if ( char_code >= 0x10000UL )
-      goto Exit;
+      return 0;
 
     if ( char_code < start )
       char_code = start;
 
     idx = (FT_UInt)( char_code - start );
     p  += 2 * idx;
 
     for ( ; idx < count; idx++ )
     {
       gindex = TT_NEXT_USHORT( p );
       if ( gindex != 0 )
       {
         result = char_code;
         break;
       }
+
+      if ( char_code >= 0xFFFFU )
+        return 0;
+
       char_code++;
     }
 
-  Exit:
     *pchar_code = result;
     return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_Error )
   tt_cmap6_get_info( TT_CMap       cmap,
                      TT_CMapInfo  *cmap_info )
   {
     FT_Byte*  p = cmap->data + 4;
@@ skipping 31 matching lines @@
   /*************************************************************************/
   /*************************************************************************/
   /*****                                                               *****/
   /*****                          FORMAT 8                             *****/
   /*****                                                               *****/
   /***** It is hard to completely understand what the OpenType spec    *****/
   /***** says about this format, but here is my conclusion.            *****/
   /*****                                                               *****/
   /***** The purpose of this format is to easily map UTF-16 text to    *****/
   /***** glyph indices.  Basically, the `char_code' must be in one of  *****/
-  /***** the following formats:                                        *****/
+  /***** the following formats.                                        *****/
   /*****                                                               *****/
   /*****   - A 16-bit value that isn't part of the Unicode Surrogates  *****/
   /*****     Area (i.e. U+D800-U+DFFF).                                *****/
   /*****                                                               *****/
   /*****   - A 32-bit value, made of two surrogate values, i.e.. if    *****/
   /*****     `char_code = (char_hi << 16) | char_lo', then both        *****/
   /*****     `char_hi' and `char_lo' must be in the Surrogates Area.   *****/
   /*****      Area.                                                    *****/
   /*****                                                               *****/
   /***** The `is32' table embedded in the charmap indicates whether a  *****/
   /***** given 16-bit value is in the surrogates area or not.          *****/
   /*****                                                               *****/
-  /***** So, for any given `char_code', we can assert the following:   *****/
+  /***** So, for any given `char_code', we can assert the following.   *****/
   /*****                                                               *****/
   /*****   If `char_hi == 0' then we must have `is32[char_lo] == 0'.   *****/
   /*****                                                               *****/
   /*****   If `char_hi != 0' then we must have both                    *****/
   /*****   `is32[char_hi] != 0' and `is32[char_lo] != 0'.              *****/
   /*****                                                               *****/
   /*************************************************************************/
   /*************************************************************************/
 
   /*************************************************************************/
@@ skipping 134 matching lines @@
     {
       start    = TT_NEXT_ULONG( p );
       end      = TT_NEXT_ULONG( p );
       start_id = TT_NEXT_ULONG( p );
 
       if ( char_code < start )
         break;
 
       if ( char_code <= end )
       {
-        result = (FT_UInt)( start_id + char_code - start );
+        if ( start_id > 0xFFFFFFFFUL - ( char_code - start ) )
+          return 0;
+
+        result = (FT_UInt)( start_id + ( char_code - start ) );
         break;
       }
     }
     return result;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap8_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
+    FT_Face    face       = cmap->cmap.charmap.face;
     FT_UInt32  result     = 0;
-    FT_UInt32  char_code  = *pchar_code + 1;
+    FT_UInt32  char_code;
     FT_UInt    gindex     = 0;
     FT_Byte*   table      = cmap->data;
     FT_Byte*   p          = table + 8204;
     FT_UInt32  num_groups = TT_NEXT_ULONG( p );
     FT_UInt32  start, end, start_id;
 
 
+    if ( *pchar_code >= 0xFFFFFFFFUL )
+      return 0;
+
+    char_code = *pchar_code + 1;
+
     p = table + 8208;
 
     for ( ; num_groups > 0; num_groups-- )
     {
       start    = TT_NEXT_ULONG( p );
       end      = TT_NEXT_ULONG( p );
       start_id = TT_NEXT_ULONG( p );
 
       if ( char_code < start )
         char_code = start;
 
+    Again:
       if ( char_code <= end )
       {
-        gindex = (FT_UInt)( char_code - start + start_id );
-        if ( gindex != 0 )
+        /* ignore invalid group */
+        if ( start_id > 0xFFFFFFFFUL - ( char_code - start ) )
+          continue;
+
+        gindex = (FT_UInt)( start_id + ( char_code - start ) );
+
+        /* does first element of group point to `.notdef' glyph? */
+        if ( gindex == 0 )
         {
-          result = char_code;
-          goto Exit;
+          if ( char_code >= 0xFFFFFFFFUL )
+            break;
+
+          char_code++;
+          goto Again;
         }
+
+        /* if `gindex' is invalid, the remaining values */
+        /* in this group are invalid, too               */
+        if ( gindex >= (FT_UInt)face->num_glyphs )
+          continue;
+
+        result = char_code;
+        break;
       }
     }
 
-  Exit:
     *pchar_code = result;
     return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_Error )
   tt_cmap8_get_info( TT_CMap       cmap,
                      TT_CMapInfo  *cmap_info )
   {
     FT_Byte*  p = cmap->data + 8;
@@ skipping 96 matching lines @@
 
   FT_CALLBACK_DEF( FT_UInt )
   tt_cmap10_char_index( TT_CMap    cmap,
                         FT_UInt32  char_code )
   {
     FT_Byte*   table  = cmap->data;
     FT_UInt    result = 0;
     FT_Byte*   p      = table + 12;
     FT_UInt32  start  = TT_NEXT_ULONG( p );
     FT_UInt32  count  = TT_NEXT_ULONG( p );
-    FT_UInt32  idx    = (FT_ULong)( char_code - start );
+    FT_UInt32  idx;
 
 
+    if ( char_code < start )
+      return 0;
+
+    idx = char_code - start;
+
     if ( idx < count )
     {
       p     += 2 * idx;
       result = TT_PEEK_USHORT( p );
     }
+
     return result;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap10_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
     FT_Byte*   table     = cmap->data;
-    FT_UInt32  char_code = *pchar_code + 1;
+    FT_UInt32  char_code;
     FT_UInt    gindex    = 0;
     FT_Byte*   p         = table + 12;
     FT_UInt32  start     = TT_NEXT_ULONG( p );
     FT_UInt32  count     = TT_NEXT_ULONG( p );
     FT_UInt32  idx;
 
 
+    if ( *pchar_code >= 0xFFFFFFFFUL )
+      return 0;
+
+    char_code = *pchar_code + 1;
+
     if ( char_code < start )
       char_code = start;
 
-    idx = (FT_UInt32)( char_code - start );
+    idx = char_code - start;
     p  += 2 * idx;
 
     for ( ; idx < count; idx++ )
     {
       gindex = TT_NEXT_USHORT( p );
       if ( gindex != 0 )
         break;
+
+      if ( char_code >= 0xFFFFFFFFUL )
+        return 0;
+
       char_code++;
     }
 
     *pchar_code = char_code;
     return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_Error )
   tt_cmap10_get_info( TT_CMap       cmap,
@@ skipping 148 matching lines @@
     return FT_Err_Ok;
   }
 
 
   /* search the index of the charcode next to cmap->cur_charcode */
   /* cmap->cur_group should be set up properly by caller         */
   /*                                                             */
   static void
   tt_cmap12_next( TT_CMap12  cmap )
   {
+    FT_Face   face = cmap->cmap.cmap.charmap.face;
     FT_Byte*  p;
     FT_ULong  start, end, start_id, char_code;
     FT_ULong  n;
     FT_UInt   gindex;
 
 
     if ( cmap->cur_charcode >= 0xFFFFFFFFUL )
       goto Fail;
 
     char_code = cmap->cur_charcode + 1;
 
     for ( n = cmap->cur_group; n < cmap->num_groups; n++ )
     {
       p        = cmap->cmap.data + 16 + 12 * n;
       start    = TT_NEXT_ULONG( p );
       end      = TT_NEXT_ULONG( p );
       start_id = TT_PEEK_ULONG( p );
 
       if ( char_code < start )
         char_code = start;
 
-      for ( ; char_code <= end; char_code++ )
+    Again:
+      if ( char_code <= end )
       {
-        gindex = (FT_UInt)( start_id + char_code - start );
+        /* ignore invalid group */
+        if ( start_id > 0xFFFFFFFFUL - ( char_code - start ) )
+          continue;
 
-        if ( gindex )
+        gindex = (FT_UInt)( start_id + ( char_code - start ) );
+
+        /* does first element of group point to `.notdef' glyph? */
+        if ( gindex == 0 )
         {
-          cmap->cur_charcode = char_code;;
-          cmap->cur_gindex   = gindex;
-          cmap->cur_group    = n;
+          if ( char_code >= 0xFFFFFFFFUL )
+            goto Fail;
 
-          return;
+          char_code++;
+          goto Again;
         }
+
+        /* if `gindex' is invalid, the remaining values */
+        /* in this group are invalid, too               */
+        if ( gindex >= (FT_UInt)face->num_glyphs )
+          continue;
+
+        cmap->cur_charcode = char_code;
+        cmap->cur_gindex   = gindex;
+        cmap->cur_group    = n;
+
+        return;
       }
     }
 
   Fail:
     cmap->valid = 0;
   }
 
 
   static FT_UInt
   tt_cmap12_char_map_binary( TT_CMap     cmap,
                              FT_UInt32*  pchar_code,
                              FT_Bool     next )
   {
     FT_UInt    gindex     = 0;
     FT_Byte*   p          = cmap->data + 12;
     FT_UInt32  num_groups = TT_PEEK_ULONG( p );
     FT_UInt32  char_code  = *pchar_code;
     FT_UInt32  start, end, start_id;
     FT_UInt32  max, min, mid;
 
 
     if ( !num_groups )
       return 0;
 
     /* make compiler happy */
     mid = num_groups;
     end = 0xFFFFFFFFUL;
 
     if ( next )
+    {
+      if ( char_code >= 0xFFFFFFFFUL )
+        return 0;
+
       char_code++;
+    }
 
     min = 0;
     max = num_groups;
 
     /* binary search */
     while ( min < max )
     {
       mid = ( min + max ) >> 1;
       p   = cmap->data + 16 + 12 * mid;
 
       start = TT_NEXT_ULONG( p );
       end   = TT_NEXT_ULONG( p );
 
       if ( char_code < start )
         max = mid;
       else if ( char_code > end )
         min = mid + 1;
       else
       {
         start_id = TT_PEEK_ULONG( p );
-        gindex = (FT_UInt)( start_id + char_code - start );
 
+        /* reject invalid glyph index */
+        if ( start_id > 0xFFFFFFFFUL - ( char_code - start ) )
+          gindex = 0;
+        else
+          gindex = (FT_UInt)( start_id + ( char_code - start ) );
         break;
       }
     }
 
     if ( next )
     {
+      FT_Face    face   = cmap->cmap.charmap.face;
       TT_CMap12  cmap12 = (TT_CMap12)cmap;
 
 
       /* if `char_code' is not in any group, then `mid' is */
       /* the group nearest to `char_code'                  */
-      /*                                                   */
 
       if ( char_code > end )
       {
         mid++;
         if ( mid == num_groups )
           return 0;
       }
 
       cmap12->valid        = 1;
       cmap12->cur_charcode = char_code;
       cmap12->cur_group    = mid;
 
+      if ( gindex >= (FT_UInt)face->num_glyphs )
+        gindex = 0;
+
       if ( !gindex )
       {
         tt_cmap12_next( cmap12 );
 
         if ( cmap12->valid )
           gindex = cmap12->cur_gindex;
       }
       else
         cmap12->cur_gindex = gindex;
 
-      if ( gindex )
-        *pchar_code = cmap12->cur_charcode;
+      *pchar_code = cmap12->cur_charcode;
     }
 
     return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt )
   tt_cmap12_char_index( TT_CMap    cmap,
                         FT_UInt32  char_code )
   {
     return tt_cmap12_char_map_binary( cmap, &char_code, 0 );
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap12_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
     TT_CMap12  cmap12 = (TT_CMap12)cmap;
-    FT_ULong   gindex;
+    FT_UInt    gindex;
 
 
-    if ( cmap12->cur_charcode >= 0xFFFFFFFFUL )
-      return 0;
-
     /* no need to search */
     if ( cmap12->valid && cmap12->cur_charcode == *pchar_code )
     {
       tt_cmap12_next( cmap12 );
       if ( cmap12->valid )
       {
-        gindex = cmap12->cur_gindex;
-
-        /* XXX: check cur_charcode overflow is expected */
-        if ( gindex )
-          *pchar_code = (FT_UInt32)cmap12->cur_charcode;
+        gindex      = cmap12->cur_gindex;
+        *pchar_code = (FT_UInt32)cmap12->cur_charcode;
       }
       else
         gindex = 0;
     }
     else
       gindex = tt_cmap12_char_map_binary( cmap, pchar_code, 1 );
 
-    /* XXX: check gindex overflow is expected */
-    return (FT_UInt32)gindex;
+    return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_Error )
   tt_cmap12_get_info( TT_CMap       cmap,
                       TT_CMapInfo  *cmap_info )
   {
     FT_Byte*  p = cmap->data + 8;
 
 
@@ skipping 138 matching lines @@
     return FT_Err_Ok;
   }
 
 
   /* search the index of the charcode next to cmap->cur_charcode */
   /* cmap->cur_group should be set up properly by caller         */
   /*                                                             */
   static void
   tt_cmap13_next( TT_CMap13  cmap )
   {
+    FT_Face   face = cmap->cmap.cmap.charmap.face;
     FT_Byte*  p;
     FT_ULong  start, end, glyph_id, char_code;
     FT_ULong  n;
     FT_UInt   gindex;
 
 
     if ( cmap->cur_charcode >= 0xFFFFFFFFUL )
       goto Fail;
 
     char_code = cmap->cur_charcode + 1;
 
     for ( n = cmap->cur_group; n < cmap->num_groups; n++ )
     {
       p        = cmap->cmap.data + 16 + 12 * n;
       start    = TT_NEXT_ULONG( p );
       end      = TT_NEXT_ULONG( p );
       glyph_id = TT_PEEK_ULONG( p );
 
       if ( char_code < start )
         char_code = start;
 
       if ( char_code <= end )
       {
         gindex = (FT_UInt)glyph_id;
 
-        if ( gindex )
+        if ( gindex && gindex < (FT_UInt)face->num_glyphs )
         {
-          cmap->cur_charcode = char_code;;
+          cmap->cur_charcode = char_code;
           cmap->cur_gindex   = gindex;
           cmap->cur_group    = n;
 
           return;
         }
       }
     }
 
   Fail:
     cmap->valid = 0;
@@ skipping 14 matching lines @@
 
 
     if ( !num_groups )
       return 0;
 
     /* make compiler happy */
     mid = num_groups;
     end = 0xFFFFFFFFUL;
 
     if ( next )
+    {
+      if ( char_code >= 0xFFFFFFFFUL )
+        return 0;
+
       char_code++;
+    }
 
     min = 0;
     max = num_groups;
 
     /* binary search */
     while ( min < max )
     {
       mid = ( min + max ) >> 1;
       p   = cmap->data + 16 + 12 * mid;
 
       start = TT_NEXT_ULONG( p );
       end   = TT_NEXT_ULONG( p );
 
       if ( char_code < start )
         max = mid;
       else if ( char_code > end )
         min = mid + 1;
       else
       {
         gindex = (FT_UInt)TT_PEEK_ULONG( p );
 
         break;
       }
     }
 
     if ( next )
     {
+      FT_Face    face   = cmap->cmap.charmap.face;
       TT_CMap13  cmap13 = (TT_CMap13)cmap;
 
 
       /* if `char_code' is not in any group, then `mid' is */
       /* the group nearest to `char_code'                  */
 
       if ( char_code > end )
       {
         mid++;
         if ( mid == num_groups )
           return 0;
       }
 
       cmap13->valid        = 1;
       cmap13->cur_charcode = char_code;
       cmap13->cur_group    = mid;
 
+      if ( gindex >= (FT_UInt)face->num_glyphs )
+        gindex = 0;
+
       if ( !gindex )
       {
         tt_cmap13_next( cmap13 );
 
         if ( cmap13->valid )
           gindex = cmap13->cur_gindex;
       }
       else
         cmap13->cur_gindex = gindex;
 
-      if ( gindex )
-        *pchar_code = cmap13->cur_charcode;
+      *pchar_code = cmap13->cur_charcode;
     }
 
     return gindex;
   }
 
 
   FT_CALLBACK_DEF( FT_UInt )
   tt_cmap13_char_index( TT_CMap    cmap,
                         FT_UInt32  char_code )
   {
     return tt_cmap13_char_map_binary( cmap, &char_code, 0 );
   }
 
 
   FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap13_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
     TT_CMap13  cmap13 = (TT_CMap13)cmap;
     FT_UInt    gindex;
 
 
-    if ( cmap13->cur_charcode >= 0xFFFFFFFFUL )
-      return 0;
-
     /* no need to search */
     if ( cmap13->valid && cmap13->cur_charcode == *pchar_code )
     {
       tt_cmap13_next( cmap13 );
       if ( cmap13->valid )
       {
-        gindex = cmap13->cur_gindex;
-        if ( gindex )
-          *pchar_code = cmap13->cur_charcode;
+        gindex      = cmap13->cur_gindex;
+        *pchar_code = cmap13->cur_charcode;
       }
       else
         gindex = 0;
     }
     else
       gindex = tt_cmap13_char_map_binary( cmap, pchar_code, 1 );
 
     return gindex;
   }
 
@@ skipping 865 matching lines @@
 
 
     if ( !p || p + 4 > limit )
       return FT_THROW( Invalid_Table );
 
     /* only recognize format 0 */
     if ( TT_NEXT_USHORT( p ) != 0 )
     {
       FT_ERROR(( "tt_face_build_cmaps:"
                  " unsupported `cmap' table format = %d\n",
-                 TT_PEEK_USHORT( p - 2) ));
+                 TT_PEEK_USHORT( p - 2 ) ));
       return FT_THROW( Invalid_Table );
     }
 
     num_cmaps = TT_NEXT_USHORT( p );
 
     for ( ; num_cmaps > 0 && p + 8 <= limit; num_cmaps-- )
     {
       FT_CharMapRec  charmap;
       FT_UInt32      offset;
 
@@ skipping 76 matching lines @@
   {
     FT_CMap        cmap  = (FT_CMap)charmap;
     TT_CMap_Class  clazz = (TT_CMap_Class)cmap->clazz;
 
 
     return clazz->get_cmap_info( charmap, cmap_info );
   }
 
 
 /* END */