Update freetype to 2.5.4.

third_party/freetype/src/cff/cffload.c

 /***************************************************************************/
 /*                                                                         */
 /*  cffload.c                                                              */
 /*                                                                         */
 /*    OpenType and CFF data/program tables loader (body).                  */
 /*                                                                         */
-/*  Copyright 1996-2013 by                                                 */
+/*  Copyright 1996-2014 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
 
-#include "../../include/ft2build.h"
-#include "../../include/freetype/internal/ftdebug.h"
-#include "../../include/freetype/internal/ftobjs.h"
-#include "../../include/freetype/internal/ftstream.h"
-#include "../../include/freetype/tttags.h"
-#include "../../include/freetype/t1tables.h"
+#include <ft2build.h>
+#include FT_INTERNAL_DEBUG_H
+#include FT_INTERNAL_OBJECTS_H
+#include FT_INTERNAL_STREAM_H
+#include FT_TRUETYPE_TAGS_H
+#include FT_TYPE1_TABLES_H
 
 #include "cffload.h"
 #include "cffparse.h"
 
 #include "cfferrs.h"
 
 
 #if 1
 
   static const FT_UShort  cff_isoadobe_charset[229] =
@@ skipping 372 matching lines @@
     {
       FT_ULong  n, cur_offset;
       FT_ULong  extra = 0;
       FT_Byte*  org_bytes = idx->bytes;
 
 
       /* at this point, `idx->offsets' can't be NULL */
       cur_offset = idx->offsets[0] - 1;
 
       /* sanity check */
-      if ( cur_offset >= idx->data_size )
+      if ( cur_offset != 0 )
       {
         FT_TRACE0(( "cff_index_get_pointers:"
                     " invalid first offset value %d set to zero\n",
                     cur_offset ));
         cur_offset = 0;
       }
 
       if ( !pool )
         t[0] = org_bytes + cur_offset;
       else
         t[0] = new_bytes + cur_offset;
 
       for ( n = 1; n <= idx->count; n++ )
       {
         FT_ULong  next_offset = idx->offsets[n] - 1;
 
 
-        /* empty slot + two sanity checks for invalid offset tables */
-        if ( next_offset == 0                                    ||
-             next_offset < cur_offset                            ||
-             ( next_offset >= idx->data_size && n < idx->count ) )
+        /* two sanity checks for invalid offset tables */
+        if ( next_offset < cur_offset )
           next_offset = cur_offset;
+        else if ( next_offset > idx->data_size )
+          next_offset = idx->data_size;
 
         if ( !pool )
           t[n] = org_bytes + next_offset;
         else
         {
           t[n] = new_bytes + next_offset + extra;
 
           if ( next_offset != cur_offset )
           {
             FT_MEM_COPY( t[n - 1], org_bytes + cur_offset, t[n] - t[n - 1] );
@@ skipping 232 matching lines @@
     switch ( format )
     {
     case 0:     /* format 0, that's simple */
       fdselect->data_size = num_glyphs;
       goto Load_Data;
 
     case 3:     /* format 3, a tad more complex */
       if ( FT_READ_USHORT( num_ranges ) )
         goto Exit;
 
+      if ( !num_ranges )
+      {
+        FT_TRACE0(( "CFF_Load_FD_Select: empty FDSelect array\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Exit;
+      }
+
       fdselect->data_size = num_ranges * 3 + 2;
 
     Load_Data:
       if ( FT_FRAME_EXTRACT( fdselect->data_size, fdselect->data ) )
         goto Exit;
       break;
 
     default:    /* hmm... that's wrong */
       error = FT_THROW( Invalid_File_Format );
     }
@@ skipping 10 matching lines @@
     FT_Byte  fd = 0;
 
 
     switch ( fdselect->format )
     {
     case 0:
       fd = fdselect->data[glyph_index];
       break;
 
     case 3:
-      /* first, compare to cache */
+      /* first, compare to the cache */
       if ( (FT_UInt)( glyph_index - fdselect->cache_first ) <
                         fdselect->cache_count )
       {
         fd = fdselect->cache_fd;
         break;
       }
 
-      /* then, lookup the ranges array */
+      /* then, look up the ranges array */
       {
         FT_Byte*  p       = fdselect->data;
         FT_Byte*  p_limit = p + fdselect->data_size;
         FT_Byte   fd2;
         FT_UInt   first, limit;
 
 
         first = FT_NEXT_USHORT( p );
         do
         {
           if ( glyph_index < first )
             break;
 
           fd2   = *p++;
           limit = FT_NEXT_USHORT( p );
 
           if ( glyph_index < limit )
           {
             fd = fd2;
 
             /* update cache */
             fdselect->cache_first = first;
-            fdselect->cache_count = limit-first;
+            fdselect->cache_count = limit - first;
             fdselect->cache_fd    = fd2;
             break;
           }
           first = limit;
 
         } while ( p < p_limit );
       }
       break;
 
     default:
@@ skipping 923 matching lines @@
 
     if ( font->cf2_instance.finalizer )
     {
       font->cf2_instance.finalizer( font->cf2_instance.data );
       FT_FREE( font->cf2_instance.data );
     }
   }
 
 
 /* END */