Update freetype to 2.5.4.

third_party/freetype/src/psaux/psobjs.c

 /***************************************************************************/
 /*                                                                         */
 /*  psobjs.c                                                               */
 /*                                                                         */
 /*    Auxiliary functions for PostScript fonts (body).                     */
 /*                                                                         */
-/*  Copyright 1996-2013 by                                                 */
+/*  Copyright 1996-2014 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
 
-#include "../../include/ft2build.h"
-#include "../../include/freetype/internal/psaux.h"
-#include "../../include/freetype/internal/ftdebug.h"
-#include "../../include/freetype/internal/ftcalc.h"
+#include <ft2build.h>
+#include FT_INTERNAL_POSTSCRIPT_AUX_H
+#include FT_INTERNAL_DEBUG_H
+#include FT_INTERNAL_CALC_H
 
 #include "psobjs.h"
 #include "psconv.h"
 
 #include "psauxerr.h"
 
 
   /*************************************************************************/
   /*                                                                       */
   /* The macro FT_COMPONENT is used in trace mode.  It is an implicit      */
@@ skipping 807 matching lines @@
 
   Exit:
     *acur = cur;
     return count;
   }
 
 
   /* first character must be a delimiter or a part of a number */
   /* NB: `values' can be NULL if we just want to skip the      */
   /*     array; in this case we ignore `max_values'            */
+  /*                                                           */
+  /* return number of successfully parsed values               */
 
   static FT_Int
   ps_tofixedarray( FT_Byte*  *acur,
                    FT_Byte*   limit,
                    FT_Int     max_values,
                    FT_Fixed*  values,
                    FT_Int     power_ten )
   {
     FT_Byte*  cur   = *acur;
     FT_Int    count = 0;
@@ skipping 243 matching lines @@
 
       case T1_FIELD_TYPE_FIXED:
         val = PS_Conv_ToFixed( &cur, limit, 0 );
         goto Store_Integer;
 
       case T1_FIELD_TYPE_FIXED_1000:
         val = PS_Conv_ToFixed( &cur, limit, 3 );
         goto Store_Integer;
 
       case T1_FIELD_TYPE_INTEGER:
-        { FT_Bool ret = xyq_PS_Conv_ToInt( &cur, limit, &val );  /* XYQ 2007-10-10: abort if not a number*/
-                if (!ret) break; }
+        val = PS_Conv_ToInt( &cur, limit );
         /* fall through */
 
       Store_Integer:
         switch ( field->size )
         {
         case (8 / FT_CHAR_BIT):
           *(FT_Byte*)q = (FT_Byte)val;
           break;
 
         case (16 / FT_CHAR_BIT):
@@ skipping 62 matching lines @@
 
           FT_MEM_COPY( string, cur, len );
           string[len] = 0;
 
           *(FT_String**)q = string;
         }
         break;
 
       case T1_FIELD_TYPE_BBOX:
         {
-                  // Add by Johnson, fix a Error #1: UNINITIALIZED READ. #testdoc 1282.pdf
-          FT_Fixed  temp[4] = {0,0,0,0};
+          FT_Fixed  temp[4];
           FT_BBox*  bbox = (FT_BBox*)q;
           FT_Int    result;
 
 
           result = ps_tofixedarray( &cur, limit, 4, temp, 0 );
 
-          if ( result < 0 )
+          if ( result < 4 )
           {
             FT_ERROR(( "ps_parser_load_field:"
                        " expected four integers in bounding box\n" ));
             error = FT_THROW( Invalid_File_Format );
             goto Exit;
           }
 
           bbox->xMin = FT_RoundFix( temp[0] );
           bbox->yMin = FT_RoundFix( temp[1] );
           bbox->xMax = FT_RoundFix( temp[2] );
           bbox->yMax = FT_RoundFix( temp[3] );
         }
         break;
 
       case T1_FIELD_TYPE_MM_BBOX:
         {
           FT_Memory  memory = parser->memory;
           FT_Fixed*  temp;
           FT_Int     result;
           FT_UInt    i;
 
 
           if ( FT_NEW_ARRAY( temp, max_objects * 4 ) )
             goto Exit;
 
           for ( i = 0; i < 4; i++ )
           {
             result = ps_tofixedarray( &cur, limit, max_objects,
                                       temp + i * max_objects, 0 );
-            if ( result < 0 )
+            if ( result < 0 || (FT_UInt)result < max_objects )
             {
               FT_ERROR(( "ps_parser_load_field:"
                          " expected %d integers in the %s subarray\n"
                          "                     "
                          " of /FontBBox in the /Blend dictionary\n",
                          max_objects,
                          i == 0 ? "first"
                                 : ( i == 1 ? "second"
                                            : ( i == 2 ? "third"
                                                       : "fourth" ) ) ));
@@ skipping 85 matching lines @@
     if ( field->type != T1_FIELD_TYPE_BBOX && field->count_offset != 0 )
       *(FT_Byte*)( (FT_Byte*)objects[0] + field->count_offset ) =
         (FT_Byte)num_elements;
 
     /* we now load each element, adjusting the field.offset on each one */
     token = elements;
     for ( ; num_elements > 0; num_elements--, token++ )
     {
       parser->cursor = token->start;
       parser->limit  = token->limit;
-      ps_parser_load_field( parser, &fieldrec, objects, max_objects, 0 );
+
+      error = ps_parser_load_field( parser,
+                                    &fieldrec,
+                                    objects,
+                                    max_objects,
+                                    0 );
+      if ( error )
+        break;
+
       fieldrec.offset += fieldrec.size;
     }
 
 #if 0  /* obsolete -- keep for reference */
     if ( pflags )
       *pflags |= 1L << field->flag_bit;
 #else
     FT_UNUSED( pflags );
 #endif
 
@@ skipping 406 matching lines @@
   {
     PS_Conv_EexecDecode( &buffer,
                          buffer + length,
                          buffer,
                          length,
                          &seed );
   }
 
 
 /* END */