summaryrefslogtreecommitdiffstats
path: root/src/3rdparty/freetype/src/cid/cidload.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/3rdparty/freetype/src/cid/cidload.c')
-rw-r--r--src/3rdparty/freetype/src/cid/cidload.c171
1 files changed, 90 insertions, 81 deletions
diff --git a/src/3rdparty/freetype/src/cid/cidload.c b/src/3rdparty/freetype/src/cid/cidload.c
index bb9136a3df..a7da8ea39d 100644
--- a/src/3rdparty/freetype/src/cid/cidload.c
+++ b/src/3rdparty/freetype/src/cid/cidload.c
@@ -4,7 +4,7 @@
*
* CID-keyed Type1 font loader (body).
*
- * Copyright (C) 1996-2020 by
+ * Copyright (C) 1996-2023 by
* David Turner, Robert Wilhelm, and Werner Lemberg.
*
* This file is part of the FreeType project, and may only be used,
@@ -41,7 +41,7 @@
/* read a single offset */
FT_LOCAL_DEF( FT_ULong )
cid_get_offset( FT_Byte* *start,
- FT_Byte offsize )
+ FT_UInt offsize )
{
FT_ULong result;
FT_Byte* p = *start;
@@ -113,7 +113,7 @@
CID_FaceDict dict;
- if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
+ if ( parser->num_dict >= cid->num_dicts )
{
FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
keyword->ident ));
@@ -155,23 +155,24 @@
FT_CALLBACK_DEF( void )
- cid_parse_font_matrix( CID_Face face,
- CID_Parser* parser )
+ cid_parse_font_matrix( FT_Face face, /* CID_Face */
+ void* parser_ )
{
+ CID_Face cidface = (CID_Face)face;
+ CID_Parser* parser = (CID_Parser*)parser_;
CID_FaceDict dict;
- FT_Face root = (FT_Face)&face->root;
FT_Fixed temp[6];
FT_Fixed temp_scale;
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ if ( parser->num_dict < cidface->cid.num_dicts )
{
FT_Matrix* matrix;
FT_Vector* offset;
FT_Int result;
- dict = face->cid.font_dicts + parser->num_dict;
+ dict = cidface->cid.font_dicts + parser->num_dict;
matrix = &dict->font_matrix;
offset = &dict->font_offset;
@@ -204,7 +205,7 @@
if ( temp_scale != 0x10000L )
{
/* set units per EM based on FontMatrix values */
- root->units_per_EM = (FT_UShort)FT_DivFix( 1000, temp_scale );
+ face->units_per_EM = (FT_UShort)FT_DivFix( 1000, temp_scale );
temp[0] = FT_DivFix( temp[0], temp_scale );
temp[1] = FT_DivFix( temp[1], temp_scale );
@@ -237,18 +238,20 @@
FT_CALLBACK_DEF( void )
- parse_fd_array( CID_Face face,
- CID_Parser* parser )
+ parse_fd_array( FT_Face face, /* CID_Face */
+ void* parser_ )
{
- CID_FaceInfo cid = &face->cid;
- FT_Memory memory = face->root.memory;
- FT_Stream stream = parser->stream;
- FT_Error error = FT_Err_Ok;
- FT_Long num_dicts;
+ CID_Face cidface = (CID_Face)face;
+ CID_Parser* parser = (CID_Parser*)parser_;
+ CID_FaceInfo cid = &cidface->cid;
+ FT_Memory memory = FT_FACE_MEMORY( face );
+ FT_Stream stream = parser->stream;
+ FT_Error error = FT_Err_Ok;
+ FT_Long num_dicts, max_dicts;
num_dicts = cid_parser_to_int( parser );
- if ( num_dicts < 0 )
+ if ( num_dicts < 0 || num_dicts > FT_INT_MAX )
{
FT_ERROR(( "parse_fd_array: invalid number of dictionaries\n" ));
goto Exit;
@@ -272,18 +275,18 @@
* need a `dup X' at the very beginning and a `put' at the end, so a
* rough guess using 100 bytes as the minimum is justified.
*/
- if ( (FT_ULong)num_dicts > stream->size / 100 )
+ max_dicts = (FT_Long)( stream->size / 100 );
+ if ( num_dicts > max_dicts )
{
FT_TRACE0(( "parse_fd_array: adjusting FDArray size"
" (from %ld to %ld)\n",
- num_dicts,
- stream->size / 100 ));
- num_dicts = (FT_Long)( stream->size / 100 );
+ num_dicts, max_dicts ));
+ num_dicts = max_dicts;
}
if ( !cid->font_dicts )
{
- FT_Int n;
+ FT_UInt n;
if ( FT_NEW_ARRAY( cid->font_dicts, num_dicts ) )
@@ -313,18 +316,20 @@
/* By mistake, `expansion_factor' appears both in PS_PrivateRec */
/* and CID_FaceDictRec (both are public header files and can't */
- /* changed). We simply copy the value. */
+ /* be thus changed). We simply copy the value. */
FT_CALLBACK_DEF( void )
- parse_expansion_factor( CID_Face face,
- CID_Parser* parser )
+ parse_expansion_factor( FT_Face face, /* CID_Face */
+ void* parser_ )
{
+ CID_Face cidface = (CID_Face)face;
+ CID_Parser* parser = (CID_Parser*)parser_;
CID_FaceDict dict;
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ if ( parser->num_dict < cidface->cid.num_dicts )
{
- dict = face->cid.font_dicts + parser->num_dict;
+ dict = cidface->cid.font_dicts + parser->num_dict;
dict->expansion_factor = cid_parser_to_fixed( parser, 0 );
dict->private_dict.expansion_factor = dict->expansion_factor;
@@ -341,11 +346,15 @@
/* to catch it for producing better trace output. */
FT_CALLBACK_DEF( void )
- parse_font_name( CID_Face face,
- CID_Parser* parser )
+ parse_font_name( FT_Face face, /* CID_Face */
+ void* parser_ )
{
#ifdef FT_DEBUG_LEVEL_TRACE
- if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
+ CID_Face cidface = (CID_Face)face;
+ CID_Parser* parser = (CID_Parser*)parser_;
+
+
+ if ( parser->num_dict < cidface->cid.num_dicts )
{
T1_TokenRec token;
FT_UInt len;
@@ -361,7 +370,7 @@
}
#else
FT_UNUSED( face );
- FT_UNUSED( parser );
+ FT_UNUSED( parser_ );
#endif
return;
@@ -427,7 +436,7 @@
parser->num_dict++;
#ifdef FT_DEBUG_LEVEL_TRACE
- FT_TRACE4(( " FontDict %d", parser->num_dict ));
+ FT_TRACE4(( " FontDict %u", parser->num_dict ));
if ( parser->num_dict > face->cid.num_dicts )
FT_TRACE4(( " (ignored)" ));
FT_TRACE4(( "\n" ));
@@ -517,7 +526,7 @@
FT_Memory memory = face->root.memory;
FT_Stream stream = face->cid_stream;
FT_Error error;
- FT_Int n;
+ FT_UInt n;
CID_Subrs subr;
FT_UInt max_offsets = 0;
FT_ULong* offsets = NULL;
@@ -552,20 +561,20 @@
goto Fail;
}
- if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
+ if ( FT_QRENEW_ARRAY( offsets, max_offsets, new_max ) )
goto Fail;
max_offsets = new_max;
}
/* read the subrmap's offsets */
- if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) ||
- FT_FRAME_ENTER( ( num_subrs + 1 ) * (FT_UInt)dict->sd_bytes ) )
+ if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) ||
+ FT_FRAME_ENTER( ( num_subrs + 1 ) * dict->sd_bytes ) )
goto Fail;
p = (FT_Byte*)stream->cursor;
for ( count = 0; count <= num_subrs; count++ )
- offsets[count] = cid_get_offset( &p, (FT_Byte)dict->sd_bytes );
+ offsets[count] = cid_get_offset( &p, dict->sd_bytes );
FT_FRAME_EXIT();
@@ -589,12 +598,12 @@
/* allocate, and read them */
data_len = offsets[num_subrs] - offsets[0];
- if ( FT_NEW_ARRAY( subr->code, num_subrs + 1 ) ||
- FT_ALLOC( subr->code[0], data_len ) )
+ if ( FT_QNEW_ARRAY( subr->code, num_subrs + 1 ) ||
+ FT_QALLOC( subr->code[0], data_len ) )
goto Fail;
if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
- FT_STREAM_READ( subr->code[0], data_len ) )
+ FT_STREAM_READ( subr->code[0], data_len ) )
goto Fail;
/* set up pointers */
@@ -665,17 +674,18 @@
static FT_Error
- cid_hex_to_binary( FT_Byte* data,
- FT_ULong data_len,
- FT_ULong offset,
- CID_Face face )
+ cid_hex_to_binary( FT_Byte* data,
+ FT_ULong data_len,
+ FT_ULong offset,
+ CID_Face face,
+ FT_ULong* data_written )
{
FT_Stream stream = face->root.stream;
FT_Error error;
FT_Byte buffer[256];
FT_Byte *p, *plimit;
- FT_Byte *d, *dlimit;
+ FT_Byte *d = data, *dlimit;
FT_Byte val;
FT_Bool upper_nibble, done;
@@ -684,7 +694,6 @@
if ( FT_STREAM_SEEK( offset ) )
goto Exit;
- d = data;
dlimit = d + data_len;
p = buffer;
plimit = p;
@@ -758,6 +767,7 @@
error = FT_Err_Ok;
Exit:
+ *data_written = (FT_ULong)( d - data );
return error;
}
@@ -770,12 +780,11 @@
CID_Parser* parser;
FT_Memory memory = face->root.memory;
FT_Error error;
- FT_Int n;
+ FT_UInt n;
CID_FaceInfo cid = &face->cid;
FT_ULong binary_length;
- FT_ULong entry_len;
cid_init_loader( &loader, face );
@@ -803,8 +812,8 @@
if ( parser->binary_length >
face->root.stream->size - parser->data_offset )
{
- FT_TRACE0(( "cid_face_open: adjusting length of binary data\n"
- " (from %ld to %ld bytes)\n",
+ FT_TRACE0(( "cid_face_open: adjusting length of binary data\n" ));
+ FT_TRACE0(( " (from %lu to %lu bytes)\n",
parser->binary_length,
face->root.stream->size - parser->data_offset ));
parser->binary_length = face->root.stream->size -
@@ -812,15 +821,16 @@
}
/* we must convert the data section from hexadecimal to binary */
- if ( FT_ALLOC( face->binary_data, parser->binary_length ) ||
+ if ( FT_QALLOC( face->binary_data, parser->binary_length ) ||
FT_SET_ERROR( cid_hex_to_binary( face->binary_data,
parser->binary_length,
parser->data_offset,
- face ) ) )
+ face,
+ &binary_length ) ) )
goto Exit;
FT_Stream_OpenMemory( face->cid_stream,
- face->binary_data, parser->binary_length );
+ face->binary_data, binary_length );
cid->data_offset = 0;
}
else
@@ -831,10 +841,10 @@
/* sanity tests */
- if ( cid->fd_bytes < 0 || cid->gd_bytes < 1 )
+ if ( cid->gd_bytes == 0 )
{
FT_ERROR(( "cid_face_open:"
- " Invalid `FDBytes' or `GDBytes' value\n" ));
+ " Invalid `GDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
@@ -843,15 +853,32 @@
if ( cid->fd_bytes > 4 || cid->gd_bytes > 4 )
{
FT_ERROR(( "cid_face_open:"
- " Values of `FDBytes' or `GDBytes' larger than 4\n"
- " "
+ " Values of `FDBytes' or `GDBytes' larger than 4\n" ));
+ FT_ERROR(( " "
" are not supported\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
binary_length = face->cid_stream->size - cid->data_offset;
- entry_len = (FT_ULong)( cid->fd_bytes + cid->gd_bytes );
+
+ if ( cid->cidmap_offset > binary_length )
+ {
+ FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
+ /* the initial pre-check prevents the multiplication overflow */
+ if ( cid->cid_count > FT_ULONG_MAX / 8 ||
+ cid->cid_count * ( cid->fd_bytes + cid->gd_bytes ) >
+ binary_length - cid->cidmap_offset )
+ {
+ FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
for ( n = 0; n < cid->num_dicts; n++ )
{
@@ -877,8 +904,7 @@
dict->private_dict.blue_fuzz = 1;
}
- if ( dict->sd_bytes < 0 ||
- ( dict->num_subrs && dict->sd_bytes < 1 ) )
+ if ( dict->num_subrs && dict->sd_bytes == 0 )
{
FT_ERROR(( "cid_face_open: Invalid `SDBytes' value\n" ));
error = FT_THROW( Invalid_File_Format );
@@ -901,11 +927,10 @@
goto Exit;
}
- /* `num_subrs' is scanned as a signed integer */
- if ( (FT_Int)dict->num_subrs < 0 ||
- ( dict->sd_bytes &&
- dict->num_subrs > ( binary_length - dict->subrmap_offset ) /
- (FT_UInt)dict->sd_bytes ) )
+ /* the initial pre-check prevents the multiplication overflow */
+ if ( dict->num_subrs > FT_UINT_MAX / 4 ||
+ dict->num_subrs * dict->sd_bytes >
+ binary_length - dict->subrmap_offset )
{
FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
@@ -913,22 +938,6 @@
}
}
- if ( cid->cidmap_offset > binary_length )
- {
- FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" ));
- error = FT_THROW( Invalid_File_Format );
- goto Exit;
- }
-
- if ( entry_len &&
- cid->cid_count >
- ( binary_length - cid->cidmap_offset ) / entry_len )
- {
- FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" ));
- error = FT_THROW( Invalid_File_Format );
- goto Exit;
- }
-
/* we can now safely proceed */
error = cid_read_subrs( face );
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-24 15:43:06 +0000