* src/base/ftmac.c: Fix a bug of PostScript font name synthesis in parse_fond().

ChangeLog

@@ -1,3 +1,14 @@
+2008-02-21  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
+
+	* src/base/ftmac.c: Fix a bug of PostScript font name synthesis
+	in parse_fond(). For any face of a specified FOND, always the
+	name for the first face was used. Except of a FOND that refers
+	multiple Type1 font files, wrong synthesized font names are not
+	used at all, so this is invisible bug. A few limit checks are
+	added to parse_fond().
+
+	* builds/mac/ftmac.c: Ditto.
+
 2008-02-21  suzuki toshiya  <mpsuzuki@hiroshima-u.ac.jp>
 
 	* builds/unix/configure.raw: Split compiler option to link Carbon

builds/mac/ftmac.c

@@ -727,6 +727,10 @@ typedef short   ResourceIndex;
     assoc      = (AsscEntry*)( fond_data + sizeof ( FamRec ) + 2 );
     base_assoc = assoc;
 
+    /* the maximum faces in a FOND is 48, size of StyleTable.indexes[] */
+    if ( 47 < face_index )
+      return;
+
     /* Let's do a little range checking before we get too excited here */
     if ( face_index < count_faces_sfnt( fond_data ) )
     {
@@ -778,9 +782,10 @@ typedef short   ResourceIndex;
           ft_memcpy(ps_name, names[0] + 1, ps_name_len);
           ps_name[ps_name_len] = 0;
         }
-        if ( style->indexes[0] > 1 )
+        if ( style->indexes[face_index] > 1 &&
+             style->indexes[face_index] <= FT_MIN( string_count, 64 ) )
         {
-          unsigned char*  suffixes = names[style->indexes[0] - 1];
+          unsigned char*  suffixes = names[style->indexes[face_index] - 1];
 
 
           for ( i = 1; i <= suffixes[0]; i++ )

src/base/ftmac.c

@@ -395,6 +395,10 @@ typedef short ResourceIndex;
     assoc      = (AsscEntry*)( fond_data + sizeof ( FamRec ) + 2 );
     base_assoc = assoc;
 
+    /* the maximum faces in a FOND is 48, size of StyleTable.indexes[] */
+    if ( 47 < face_index )
+      return;
+
     /* Let's do a little range checking before we get too excited here */
     if ( face_index < count_faces_sfnt( fond_data ) )
     {
@@ -446,9 +450,10 @@ typedef short ResourceIndex;
           ft_memcpy(ps_name, names[0] + 1, ps_name_len);
           ps_name[ps_name_len] = 0;
         }
-        if ( style->indexes[0] > 1 )
+        if ( style->indexes[face_index] > 1 &&
+             style->indexes[face_index] <= FT_MIN( string_count, 64 ) )
         {
-          unsigned char*  suffixes = names[style->indexes[0] - 1];
+          unsigned char*  suffixes = names[style->indexes[face_index] - 1];
 
 
           for ( i = 1; i <= suffixes[0]; i++ )