Update freetype to 2.5.4.

third_party/freetype/src/type1/t1load.c

 /***************************************************************************/
 /*                                                                         */
 /*  t1load.c                                                               */
 /*                                                                         */
 /*    Type 1 font loader (body).                                           */
 /*                                                                         */
-/*  Copyright 1996-2013 by                                                 */
+/*  Copyright 1996-2014 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
 /*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
 /*  this file you indicate that you have read the license and              */
 /*  understand and accept it fully.                                        */
 /*                                                                         */
 /***************************************************************************/
 
@@ skipping 35 matching lines @@
   /* This is by far the fastest way one can find to parse and read all     */
   /* data.                                                                 */
   /*                                                                       */
   /* This led to tremendous code size reduction.  Note that later, the     */
   /* glyph loader will also be _greatly_ simplified, and the automatic     */
   /* hinter will replace the clumsy `t1hinter'.                            */
   /*                                                                       */
   /*************************************************************************/
 
 
-#include "../../include/ft2build.h"
-#include "../../include/freetype/internal/ftdebug.h"
-#include "../../include/freetype/config/ftconfig.h"
-#include "../../include/freetype/ftmm.h"
-#include "../../include/freetype/internal/t1types.h"
-#include "../../include/freetype/internal/ftcalc.h"
+#include <ft2build.h>
+#include FT_INTERNAL_DEBUG_H
+#include FT_CONFIG_CONFIG_H
+#include FT_MULTIPLE_MASTERS_H
+#include FT_INTERNAL_TYPE1_TYPES_H
+#include FT_INTERNAL_CALC_H
 
 #include "t1load.h"
 #include "t1errors.h"
 
 
 #ifdef FT_CONFIG_OPTION_INCREMENTAL
 #define IS_INCREMENTAL  (FT_Bool)( face->root.internal->incremental_interface != 0 )
 #else
 #define IS_INCREMENTAL  0
 #endif
@@ skipping 291 matching lines @@
     PS_Blend  blend = face->blend;
     FT_Error  error;
     FT_UInt   n, m;
 
 
     error = FT_ERR( Invalid_Argument );
 
     if ( blend && blend->num_axis == num_coords )
     {
       /* recompute the weight vector from the blend coordinates */
-      error = FT_Err_Ok;
-
       for ( n = 0; n < blend->num_designs; n++ )
       {
         FT_Fixed  result = 0x10000L;  /* 1.0 fixed */
 
 
         for ( m = 0; m < blend->num_axis; m++ )
         {
           FT_Fixed  factor;
 
 
@@ skipping 701 matching lines @@
   /* and `/CharStrings' dictionaries.                                */
 
   static void
   t1_parse_font_matrix( T1_Face    face,
                         T1_Loader  loader )
   {
     T1_Parser   parser = &loader->parser;
     FT_Matrix*  matrix = &face->type1.font_matrix;
     FT_Vector*  offset = &face->type1.font_offset;
     FT_Face     root   = (FT_Face)&face->root;
-    FT_Fixed    temp[6] = {0, 0, 0, 0, 0, 0};
-    FT_Fixed    temp_scale = 0;
+    FT_Fixed    temp[6];
+    FT_Fixed    temp_scale;
     FT_Int      result;
 
 
     result = T1_ToFixedArray( parser, 6, temp, 3 );
 
-    if ( result < 0 )
+    if ( result < 6 )
     {
       parser->root.error = FT_THROW( Invalid_File_Format );
       return;
     }
 
     temp_scale = FT_ABS( temp[3] );
 
     if ( temp_scale == 0 )
     {
       FT_ERROR(( "t1_parse_font_matrix: invalid font matrix\n" ));
@@ skipping 85 matching lines @@
         parser->root.error = error;
         return;
       }
 
       /* We need to `zero' out encoding_table.elements */
       for ( n = 0; n < count; n++ )
       {
         char*  notdef = (char *)".notdef";
 
 
-        T1_Add_Table( char_table, n, notdef, 8 );
+        (void)T1_Add_Table( char_table, n, notdef, 8 );
       }
 
       /* Now we need to read records of the form                */
       /*                                                        */
       /*   ... charcode /charname ...                           */
       /*                                                        */
       /* for each entry in our table.                           */
       /*                                                        */
       /* We simply look for a number followed by an immediate   */
       /* name.  Note that this ignores correctly the sequence   */
@@ skipping 40 matching lines @@
         {
           FT_Int  charcode;
 
 
           if ( only_immediates )
             charcode = n;
           else
           {
             charcode = (FT_Int)T1_ToInt( parser );
             T1_Skip_Spaces( parser );
+
+            /* protect against invalid charcode */
+            if ( cur == parser->root.cursor )
+            {
+              parser->root.error = FT_THROW( Unknown_File_Format );
+              return;
+            }
           }
 
           cur = parser->root.cursor;
 
           if ( cur + 2 < limit && *cur == '/' && n < count )
           {
             FT_PtrDist  len;
 
 
             cur++;
@@ skipping 297 matching lines @@
             break;
         }
 
         if ( cur[0] == 'e' &&
              cur[1] == 'n' &&
              cur[2] == 'd' )
           break;
       }
 
       T1_Skip_PS_Token( parser );
+      if ( parser->root.cursor >= limit )
+      {
+        error = FT_THROW( Invalid_File_Format );
+        goto Fail;
+      }
       if ( parser->root.error )
         return;
 
       if ( *cur == '/' )
       {
         FT_PtrDist  len;
 
 
-        if ( cur + 1 >= limit )
+        if ( cur + 2 >= limit )
         {
           error = FT_THROW( Invalid_File_Format );
           goto Fail;
         }
 
         cur++;                              /* skip `/' */
         len = parser->root.cursor - cur;
 
         if ( !read_binary_data( parser, &size, &base, IS_INCREMENTAL ) )
           return;
-                /* xhl: Add boundary check here. Fix the bug reported by ifilter. */
-                /* TESTDOC: bug# 0018509, 45.pdf. */
-                if (base + size >= limit) {
-                        error = T1_Err_Invalid_File_Format;
-                        goto Fail;
-                }
+
         /* for some non-standard fonts like `Optima' which provides */
         /* different outlines depending on the resolution it is     */
         /* possible to get here twice                               */
         if ( loader->num_glyphs )
           continue;
 
         error = T1_Add_Table( name_table, n, cur, len + 1 );
         if ( error )
           goto Fail;
 
@@ skipping 578 matching lines @@
     /* the `lengths' field must be released later             */
     type1->glyph_names_block    = loader.glyph_names.block;
     type1->glyph_names          = (FT_String**)loader.glyph_names.elements;
     loader.glyph_names.block    = 0;
     loader.glyph_names.elements = 0;
 
     /* we must now build type1.encoding when we have a custom array */
     if ( type1->encoding_type == T1_ENCODING_TYPE_ARRAY )
     {
       FT_Int    charcode, idx, min_char, max_char;
-      FT_Byte*  char_name;
       FT_Byte*  glyph_name;
 
 
       /* OK, we do the following: for each element in the encoding  */
       /* table, look up the index of the glyph having the same name */
       /* the index is then stored in type1.encoding.char_index, and */
       /* the name to type1.encoding.char_name                       */
 
       min_char = 0;
       max_char = 0;
 
       charcode = 0;
       for ( ; charcode < loader.encoding_table.max_elems; charcode++ )
       {
+        FT_Byte*  char_name;
+
+
         type1->encoding.char_index[charcode] = 0;
         type1->encoding.char_name [charcode] = (char *)".notdef";
 
         char_name = loader.encoding_table.elements[charcode];
         if ( char_name )
           for ( idx = 0; idx < type1->num_glyphs; idx++ )
           {
             glyph_name = (FT_Byte*)type1->glyph_names[idx];
             if ( ft_strcmp( (const char*)char_name,
                             (const char*)glyph_name ) == 0 )
@@ skipping 21 matching lines @@
       type1->encoding.num_chars  = loader.num_chars;
     }
 
   Exit:
     t1_done_loader( &loader );
     return error;
   }
 
 
 /* END */