@ -188,6 +188,9 @@
if ( FT_STREAM_SEEK ( offset ) | | FT_FRAME_ENTER ( byte_count ) )
return error ;
loader - > cursor = stream - > cursor ;
loader - > limit = stream - > limit ;
return TT_Err_Ok ;
}
@ -205,26 +208,26 @@
FT_CALLBACK_DEF ( FT_Error )
TT_Load_Glyph_Header ( TT_Loader loader )
{
FT_Stream stream = loader - > stream ;
FT_Int byte_len = loader - > byte_len - 10 ;
FT_Byte * p = loader - > cursor ;
FT_Byte * limit = loader - > limit ;
if ( byte_len < 0 )
if ( p + 10 > limit )
return TT_Err_Invalid_Outline ;
loader - > n_contours = FT_GET_SHORT ( ) ;
loader - > n_contours = FT_NEXT_SHORT ( p ) ;
loader - > bbox . xMin = FT_GET_SHORT ( ) ;
loader - > bbox . yMin = FT_GET_SHORT ( ) ;
loader - > bbox . xMax = FT_GET_SHORT ( ) ;
loader - > bbox . yMax = FT_GET_SHORT ( ) ;
loader - > bbox . xMin = FT_NEXT_SHORT ( p ) ;
loader - > bbox . yMin = FT_NEXT_SHORT ( p ) ;
loader - > bbox . xMax = FT_NEXT_SHORT ( p ) ;
loader - > bbox . yMax = FT_NEXT_SHORT ( p ) ;
FT_TRACE5 ( ( " # of contours: %d \n " , loader - > n_contours ) ) ;
FT_TRACE5 ( ( " xMin: %4d xMax: %4d \n " , loader - > bbox . xMin ,
loader - > bbox . xMax ) ) ;
FT_TRACE5 ( ( " yMin: %4d yMax: %4d \n " , loader - > bbox . yMin ,
loader - > bbox . yMax ) ) ;
loader - > byte_len = byte_len ;
loader - > cursor = p ;
return TT_Err_Ok ;
}
@ -234,14 +237,14 @@
TT_Load_Simple_Glyph ( TT_Loader load )
{
FT_Error error ;
FT_Stream stream = load - > stream ;
FT_Byte * p = load - > cursor ;
FT_Byte * limit = load - > limit ;
FT_GlyphLoader gloader = load - > gloader ;
FT_Int n_contours = load - > n_contours ;
FT_Outline * outline ;
TT_Face face = ( TT_Face ) load - > face ;
FT_UShort n_ins ;
FT_Int n , n_points ;
FT_Int byte_len = load - > byte_len ;
FT_Byte * flag , * flag_limit ;
FT_Byte c , count ;
@ -260,12 +263,11 @@
cont_limit = cont + n_contours ;
/* check space for contours array + instructions count */
byte_len - = 2 * ( n_contours + 1 ) ;
if ( byte_len < 0 )
if ( n_contours > = 0xFFF | | p + ( n_contours + 1 ) * 2 > limit )
goto Invalid_Outline ;
for ( ; cont < cont_limit ; cont + + )
cont [ 0 ] = FT_GET_USHORT ( ) ;
cont [ 0 ] = FT_NEXT_USHORT ( p ) ;
n_points = 0 ;
if ( n_contours > 0 )
@ -287,7 +289,10 @@
load - > glyph - > control_len = 0 ;
load - > glyph - > control_data = 0 ;
n_ins = FT_GET_USHORT ( ) ;
if ( p + 2 > limit )
goto Invalid_Outline ;
n_ins = FT_NEXT_USHORT ( p ) ;
FT_TRACE5 ( ( " Instructions size: %u \n " , n_ins ) ) ;
@ -298,8 +303,7 @@
goto Fail ;
}
byte_len - = ( FT_Int ) n_ins ;
if ( byte_len < 0 )
if ( ( limit - p ) < n_ins )
{
FT_TRACE0 ( ( " TT_Load_Simple_Glyph: Instruction count mismatch! \n " ) ) ;
error = TT_Err_Too_Many_Hints ;
@ -313,12 +317,12 @@
load - > glyph - > control_len = n_ins ;
load - > glyph - > control_data = load - > exec - > glyphIns ;
FT_MEM_COPY ( load - > exec - > glyphIns , stream - > cursor , ( FT_Long ) n_ins ) ;
FT_MEM_COPY ( load - > exec - > glyphIns , p , ( FT_Long ) n_ins ) ;
}
# endif /* TT_CONFIG_OPTION_BYTECODE_INTERPRETER */
stream - > cursor + = ( FT_Int ) n_ins ;
p + = n_ins ;
/* reading the point tags */
flag = ( FT_Byte * ) outline - > tags ;
@ -328,16 +332,16 @@
while ( flag < flag_limit )
{
if ( - - byte_len < 0 )
if ( p + 1 > limit )
goto Invalid_Outline ;
* flag + + = c = FT_GET_BYTE ( ) ;
* flag + + = c = FT_NEXT_BYTE ( p ) ;
if ( c & 8 )
{
if ( - - byte_len < 0 )
if ( p + 1 > limit )
goto Invalid_Outline ;
count = FT_GET_BYTE ( ) ;
count = FT_NEXT_BYTE ( p ) ;
if ( flag + ( FT_Int ) count > flag_limit )
goto Invalid_Outline ;
@ -346,23 +350,6 @@
}
}
/* check that there is enough room to load the coordinates */
for ( flag = ( FT_Byte * ) outline - > tags ; flag < flag_limit ; flag + + )
{
if ( * flag & 2 )
byte_len - = 1 ;
else if ( ( * flag & 16 ) = = 0 )
byte_len - = 2 ;
if ( * flag & 4 )
byte_len - = 1 ;
else if ( ( * flag & 32 ) = = 0 )
byte_len - = 2 ;
}
if ( byte_len < 0 )
goto Invalid_Outline ;
/* reading the X coordinates */
vec = outline - > points ;
@ -377,12 +364,20 @@
if ( * flag & 2 )
{
y = ( FT_Pos ) FT_GET_BYTE ( ) ;
if ( p + 1 > limit )
goto Invalid_Outline ;
y = ( FT_Pos ) FT_NEXT_BYTE ( p ) ;
if ( ( * flag & 16 ) = = 0 )
y = - y ;
}
else if ( ( * flag & 16 ) = = 0 )
y = ( FT_Pos ) FT_GET_SHORT ( ) ;
{
if ( p + 2 > limit )
goto Invalid_Outline ;
y = ( FT_Pos ) FT_NEXT_SHORT ( p ) ;
}
x + = y ;
vec - > x = x ;
@ -402,12 +397,20 @@
if ( * flag & 4 )
{
y = ( FT_Pos ) FT_GET_BYTE ( ) ;
if ( p + 1 > limit )
goto Invalid_Outline ;
y = ( FT_Pos ) FT_NEXT_BYTE ( p ) ;
if ( ( * flag & 32 ) = = 0 )
y = - y ;
}
else if ( ( * flag & 32 ) = = 0 )
y = ( FT_Pos ) FT_GET_SHORT ( ) ;
{
if ( p + 2 > limit )
goto Invalid_Outline ;
y = ( FT_Pos ) FT_NEXT_SHORT ( p ) ;
}
x + = y ;
vec - > y = x ;
@ -420,7 +423,7 @@
outline - > n_points = ( FT_UShort ) n_points ;
outline - > n_contours = ( FT_Short ) n_contours ;
load - > byte_len = byte_len ;
load - > cursor = p ;
Fail :
return error ;
@ -435,11 +438,11 @@
TT_Load_Composite_Glyph ( TT_Loader loader )
{
FT_Error error ;
FT_Stream stream = loader - > stream ;
FT_Byte * p = loader - > cursor ;
FT_Byte * limit = loader - > limit ;
FT_GlyphLoader gloader = loader - > gloader ;
FT_SubGlyph subglyph ;
FT_UInt num_subglyphs ;
FT_Int byte_len = loader - > byte_len ;
num_subglyphs = 0 ;
@ -447,6 +450,7 @@
do
{
FT_Fixed xx , xy , yy , yx ;
FT_UInt count ;
/* check that we can load a new subglyph */
@ -455,41 +459,40 @@
goto Fail ;
/* check space */
byte_len - = 4 ;
if ( byte_len < 0 )
if ( p + 4 > limit )
goto Invalid_Composite ;
subglyph = gloader - > current . subglyphs + num_subglyphs ;
subglyph - > arg1 = subglyph - > arg2 = 0 ;
subglyph - > flags = FT_GET_USHORT ( ) ;
subglyph - > index = FT_GET_USHORT ( ) ;
subglyph - > flags = FT_NEXT_USHORT ( p ) ;
subglyph - > index = FT_NEXT_USHORT ( p ) ;
/* check space */
byte_len - = 2 ;
count = 2 ;
if ( subglyph - > flags & ARGS_ARE_WORDS )
byte_len - = 2 ;
count + = 2 ;
if ( subglyph - > flags & WE_HAVE_A_SCALE )
byte_len - = 2 ;
count + = 2 ;
else if ( subglyph - > flags & WE_HAVE_AN_XY_SCALE )
byte_len - = 4 ;
count + = 4 ;
else if ( subglyph - > flags & WE_HAVE_A_2X2 )
byte_len - = 8 ;
count + = 8 ;
if ( byte_len < 0 )
if ( p + count > limit )
goto Invalid_Composite ;
/* read arguments */
if ( subglyph - > flags & ARGS_ARE_WORDS )
{
subglyph - > arg1 = FT_GET_SHORT ( ) ;
subglyph - > arg2 = FT_GET_SHORT ( ) ;
subglyph - > arg1 = FT_NEXT_SHORT ( p ) ;
subglyph - > arg2 = FT_NEXT_SHORT ( p ) ;
}
else
{
subglyph - > arg1 = FT_GET_CHAR ( ) ;
subglyph - > arg2 = FT_GET_CHAR ( ) ;
subglyph - > arg1 = FT_NEXT_CHAR ( p ) ;
subglyph - > arg2 = FT_NEXT_CHAR ( p ) ;
}
/* read transform */
@ -498,20 +501,20 @@
if ( subglyph - > flags & WE_HAVE_A_SCALE )
{
xx = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
xx = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
yy = xx ;
}
else if ( subglyph - > flags & WE_HAVE_AN_XY_SCALE )
{
xx = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
yy = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
xx = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
yy = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
}
else if ( subglyph - > flags & WE_HAVE_A_2X2 )
{
xx = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
yx = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
xy = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
yy = ( FT_Fixed ) FT_GET_SHORT ( ) < < 2 ;
xx = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
yx = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
xy = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
yy = ( FT_Fixed ) FT_NEXT_SHORT ( p ) < < 2 ;
}
subglyph - > transform . xx = xx ;
@ -533,12 +536,12 @@
/* we will process them later... */
/* */
loader - > ins_pos = ( FT_ULong ) ( FT_STREAM_POS ( ) +
stream - > cursor - stream - > limit ) ;
p - limit ) ;
}
# endif
loader - > byte_len = byte_len ;
loader - > cursor = p ;
Fail :
return error ;