Update bundled FreeType to 2.5.5

Removed everything, imported with help of import_from_tarball.sh script,
and then added a pre-generated builds/unix/ftconfig.h

Task-number: QTBUG-44648
Change-Id: Iea948e41f7761f1580382b3763d04c7a61383382
Reviewed-by: Lars Knoll <lars.knoll@digia.com>

1 files changed, 62 insertions, 33 deletions

diff --git a/src/3rdparty/freetype/src/cid/cidload.c b/src/3rdparty/freetype/src/cid/cidload.c
index 3bb359446f..1cda0eee7a 100644
--- a/src/3rdparty/freetype/src/cid/cidload.c
+++ b/src/3rdparty/freetype/src/cid/cidload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    CID-keyed Type1 font loader (body).                                  */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2009 by             */
+/*  Copyright 1996-2006, 2009, 2011-2014 by                                */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -42,7 +42,7 @@
   cid_get_offset( FT_Byte*  *start,
                   FT_Byte    offsize )
   {
-    FT_Long   result;
+    FT_ULong  result;
     FT_Byte*  p = *start;
 
 
@@ -53,7 +53,7 @@
     }
 
     *start = p;
-    return result;
+    return (FT_Long)result;
   }
 
 
@@ -110,11 +110,11 @@
         CID_FaceDict  dict;
 
 
-        if ( parser->num_dict < 0 )
+        if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
         {
           FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
                      keyword->ident ));
-          error = CID_Err_Syntax_Error;
+          error = FT_THROW( Syntax_Error );
           goto Exit;
         }
 
@@ -147,32 +147,44 @@
 
 
   FT_CALLBACK_DEF( FT_Error )
-  parse_font_matrix( CID_Face     face,
-                     CID_Parser*  parser )
+  cid_parse_font_matrix( CID_Face     face,
+                         CID_Parser*  parser )
   {
-    FT_Matrix*    matrix;
-    FT_Vector*    offset;
     CID_FaceDict  dict;
     FT_Face       root = (FT_Face)&face->root;
     FT_Fixed      temp[6];
     FT_Fixed      temp_scale;
 
 
-    if ( parser->num_dict >= 0 )
+    if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
     {
+      FT_Matrix*  matrix;
+      FT_Vector*  offset;
+      FT_Int      result;
+
+
       dict   = face->cid.font_dicts + parser->num_dict;
       matrix = &dict->font_matrix;
       offset = &dict->font_offset;
 
-      (void)cid_parser_to_fixed_array( parser, 6, temp, 3 );
+      result = cid_parser_to_fixed_array( parser, 6, temp, 3 );
+
+      if ( result < 6 )
+        return FT_THROW( Invalid_File_Format );
 
       temp_scale = FT_ABS( temp[3] );
 
-      /* Set units per EM based on FontMatrix values.  We set the value to */
-      /* `1000/temp_scale', because temp_scale was already multiplied by   */
-      /* 1000 (in `t1_tofixed', from psobjs.c).                            */
-      root->units_per_EM = (FT_UShort)( FT_DivFix( 0x10000L,
-                                        FT_DivFix( temp_scale, 1000 ) ) );
+      if ( temp_scale == 0 )
+      {
+        FT_ERROR(( "cid_parse_font_matrix: invalid font matrix\n" ));
+        return FT_THROW( Invalid_File_Format );
+      }
+
+      /* Set Units per EM based on FontMatrix values.  We set the value to */
+      /* 1000 / temp_scale, because temp_scale was already multiplied by   */
+      /* 1000 (in t1_tofixed, from psobjs.c).                              */
+
+      root->units_per_EM = (FT_UShort)FT_DivFix( 1000, temp_scale );
 
       /* we need to scale the values by 1.0/temp[3] */
       if ( temp_scale != 0x10000L )
@@ -182,7 +194,7 @@
         temp[2] = FT_DivFix( temp[2], temp_scale );
         temp[4] = FT_DivFix( temp[4], temp_scale );
         temp[5] = FT_DivFix( temp[5], temp_scale );
-        temp[3] = 0x10000L;
+        temp[3] = temp[3] < 0 ? -0x10000L : 0x10000L;
       }
 
       matrix->xx = temp[0];
@@ -195,8 +207,7 @@
       offset->y  = temp[5] >> 16;
     }
 
-    return CID_Err_Ok;      /* this is a callback function; */
-                            /* we must return an error code */
+    return FT_Err_Ok;
   }
 
 
@@ -206,7 +217,7 @@
   {
     CID_FaceInfo  cid    = &face->cid;
     FT_Memory     memory = face->root.memory;
-    FT_Error      error  = CID_Err_Ok;
+    FT_Error      error  = FT_Err_Ok;
     FT_Long       num_dicts;
 
 
@@ -249,7 +260,7 @@
     CID_FaceDict  dict;
 
 
-    if ( parser->num_dict >= 0 )
+    if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
     {
       dict = face->cid.font_dicts + parser->num_dict;
 
@@ -257,7 +268,7 @@
       dict->private_dict.expansion_factor = dict->expansion_factor;
     }
 
-    return CID_Err_Ok;
+    return FT_Err_Ok;
   }
 
 
@@ -268,7 +279,7 @@
 #include "cidtoken.h"
 
     T1_FIELD_CALLBACK( "FDArray",         parse_fd_array, 0 )
-    T1_FIELD_CALLBACK( "FontMatrix",      parse_font_matrix, 0 )
+    T1_FIELD_CALLBACK( "FontMatrix",      cid_parse_font_matrix, 0 )
     T1_FIELD_CALLBACK( "ExpansionFactor", parse_expansion_factor, 0 )
 
     { 0, T1_FIELD_LOCATION_CID_INFO, T1_FIELD_TYPE_NONE, 0, 0, 0, 0, 0, 0 }
@@ -286,7 +297,7 @@
 
     parser->root.cursor = base;
     parser->root.limit  = base + size;
-    parser->root.error  = CID_Err_Ok;
+    parser->root.error  = FT_Err_Ok;
 
     {
       FT_Byte*  cur   = base;
@@ -413,12 +424,25 @@
       FT_Byte*      p;
 
 
+      /* Check for possible overflow. */
+      if ( num_subrs == FT_UINT_MAX )
+      {
+        error = FT_THROW( Syntax_Error );
+        goto Fail;
+      }
+
       /* reallocate offsets array if needed */
       if ( num_subrs + 1 > max_offsets )
       {
         FT_UInt  new_max = FT_PAD_CEIL( num_subrs + 1, 4 );
 
 
+        if ( new_max <= max_offsets )
+        {
+          error = FT_THROW( Syntax_Error );
+          goto Fail;
+        }
+
         if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
           goto Fail;
 
@@ -436,6 +460,11 @@
 
       FT_FRAME_EXIT();
 
+      /* offsets must be ordered */
+      for ( count = 1; count <= num_subrs; count++ )
+        if ( offsets[count - 1] > offsets[count] )
+          goto Fail;
+
       /* now, compute the size of subrs charstrings, */
       /* allocate, and read them                     */
       data_len = offsets[num_subrs] - offsets[0];
@@ -495,8 +524,8 @@
 
 
   static void
-  t1_init_loader( CID_Loader*  loader,
-                  CID_Face     face )
+  cid_init_loader( CID_Loader*  loader,
+                   CID_Face     face )
   {
     FT_UNUSED( face );
 
@@ -504,8 +533,8 @@
   }
 
 
-  static void
-  t1_done_loader( CID_Loader*  loader )
+  static  void
+  cid_done_loader( CID_Loader*  loader )
   {
     CID_Parser*  parser = &loader->parser;
 
@@ -553,7 +582,7 @@
 
         if ( size == 0 )
         {
-          error = CID_Err_Syntax_Error;
+          error = FT_THROW( Syntax_Error );
           goto Exit;
         }
 
@@ -586,7 +615,7 @@
       }
       else
       {
-        error = CID_Err_Syntax_Error;
+        error = FT_THROW( Syntax_Error );
         goto Exit;
       }
 
@@ -606,7 +635,7 @@
       p++;
     }
 
-    error = CID_Err_Ok;
+    error = FT_Err_Ok;
 
   Exit:
     return error;
@@ -623,7 +652,7 @@
     FT_Error     error;
 
 
-    t1_init_loader( &loader, face );
+    cid_init_loader( &loader, face );
 
     parser = &loader.parser;
     error = cid_parser_new( parser, face->root.stream, face->root.memory,
@@ -664,7 +693,7 @@
     error = cid_read_subrs( face );
 
   Exit:
-    t1_done_loader( &loader );
+    cid_done_loader( &loader );
     return error;
   }