1 files changed, 43 insertions, 13 deletions

diff --git a/src/3rdparty/freetype/src/otvalid/otvgpos.c b/src/3rdparty/freetype/src/otvalid/otvgpos.c
index 44c43c53a1..696b35cae6 100644
--- a/src/3rdparty/freetype/src/otvalid/otvgpos.c
+++ b/src/3rdparty/freetype/src/otvalid/otvgpos.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    OpenType GPOS table validation (body).                               */
 /*                                                                         */
-/*  Copyright 2002-2015 by                                                 */
+/*  Copyright 2002-2018 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -130,7 +130,7 @@
     otv_MarkArray_validate( table + Array1, otvalid );
 
     otvalid->nesting_level++;
-    func          = otvalid->func[otvalid->nesting_level];
+    func            = otvalid->func[otvalid->nesting_level];
     otvalid->extra1 = ClassCount;
 
     func( table + Array2, otvalid );
@@ -218,10 +218,6 @@
         OTV_LIMIT_CHECK( 2 );
         OTV_OPTIONAL_OFFSET( device );
 
-        /* XXX: this value is usually too small, especially if the current */
-        /* ValueRecord is part of an array -- getting the correct table    */
-        /* size is probably not worth the trouble                          */
-
         table_size = p - otvalid->extra3;
 
         OTV_SIZE_CHECK( device );
@@ -271,7 +267,7 @@
 
     case 3:
       {
-        FT_UInt   table_size;
+        FT_UInt  table_size;
 
         OTV_OPTIONAL_TABLE( XDeviceTable );
         OTV_OPTIONAL_TABLE( YDeviceTable );
@@ -426,6 +422,8 @@
   /*************************************************************************/
   /*************************************************************************/
 
+  /* sets otvalid->extra3 (pointer to base table) */
+
   static void
   otv_PairSet_validate( FT_Bytes       table,
                         FT_UInt        format1,
@@ -438,6 +436,8 @@
 
     OTV_NAME_ENTER( "PairSet" );
 
+    otvalid->extra3 = table;
+
     OTV_LIMIT_CHECK( 2 );
     PairValueCount = FT_NEXT_USHORT( p );
 
@@ -483,8 +483,6 @@
 
     OTV_TRACE(( " (format %d)\n", PosFormat ));
 
-    otvalid->extra3 = table;
-
     switch ( PosFormat )
     {
     case 1:     /* PairPosFormat1 */
@@ -537,7 +535,9 @@
         otv_ClassDef_validate( table + ClassDef2, otvalid );
 
         OTV_LIMIT_CHECK( ClassCount1 * ClassCount2 *
-                     ( len_value1 + len_value2 ) );
+                         ( len_value1 + len_value2 ) );
+
+        otvalid->extra3 = table;
 
         /* Class1Record */
         for ( ; ClassCount1 > 0; ClassCount1-- )
@@ -985,20 +985,42 @@
   {
     OTV_ValidatorRec  validrec;
     OTV_Validator     otvalid = &validrec;
-    FT_Bytes          p     = table;
+    FT_Bytes          p       = table;
+    FT_UInt           table_size;
+    FT_UShort         version;
     FT_UInt           ScriptList, FeatureList, LookupList;
 
+    OTV_OPTIONAL_TABLE32( featureVariations );
+
 
     otvalid->root = ftvalid;
 
     FT_TRACE3(( "validating GPOS table\n" ));
     OTV_INIT;
 
-    OTV_LIMIT_CHECK( 10 );
+    OTV_LIMIT_CHECK( 4 );
 
-    if ( FT_NEXT_ULONG( p ) != 0x10000UL )      /* Version */
+    if ( FT_NEXT_USHORT( p ) != 1 )  /* majorVersion */
       FT_INVALID_FORMAT;
 
+    version = FT_NEXT_USHORT( p );   /* minorVersion */
+
+    table_size = 10;
+    switch ( version )
+    {
+    case 0:
+      OTV_LIMIT_CHECK( 6 );
+      break;
+
+    case 1:
+      OTV_LIMIT_CHECK( 10 );
+      table_size += 4;
+      break;
+
+    default:
+      FT_INVALID_FORMAT;
+    }
+
     ScriptList  = FT_NEXT_USHORT( p );
     FeatureList = FT_NEXT_USHORT( p );
     LookupList  = FT_NEXT_USHORT( p );
@@ -1014,6 +1036,14 @@
     otv_ScriptList_validate( table + ScriptList, table + FeatureList,
                              otvalid );
 
+    if ( version > 0 )
+    {
+      OTV_OPTIONAL_OFFSET32( featureVariations );
+      OTV_SIZE_CHECK32( featureVariations );
+      if ( featureVariations )
+        OTV_TRACE(( "  [omitting featureVariations validation]\n" )); /* XXX */
+    }
+
     FT_TRACE4(( "\n" ));
   }