[Git][freetype/freetype][master] [sfnt] Avoid undefined shifts in `COLR` v1 paint parsing

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 9597fd7b
  by Dominik Röttsches at 2021-11-13T06:48:23+00:00

  [sfnt] Avoid undefined shifts in `COLR` v1 paint parsing
  
  * src/sfnt/ttcolr.c (read_paint, tt_face_get_paint): Tighten shift
  behavior by using multiplication, mostly using macros from ftcalc.h.
  
  Fixes: https://bugs.chromium.org/p/chromium/issues/detail?id=1269168
  

1 changed file:

• src/sfnt/ttcolr.c

Changes:

src/sfnt/ttcolr.c

---

...	...	@@ -27,6 +27,7 @@
27	27	*/
28	28
29	29
	30	+#include <freetype/internal/ftcalc.h>
30	31	#include <freetype/internal/ftdebug.h>
31	32	#include <freetype/internal/ftstream.h>
32	33	#include <freetype/tttags.h>
...	...	@@ -509,12 +510,12 @@
509	510	* In order to support variations expose these as FT_Fixed 16.16 values so
510	511	* that we can support fractional values after interpolation.
511	512	*/
512		- apaint->u.linear_gradient.p0.x = FT_NEXT_SHORT( p ) << 16;
513		- apaint->u.linear_gradient.p0.y = FT_NEXT_SHORT( p ) << 16;
514		- apaint->u.linear_gradient.p1.x = FT_NEXT_SHORT( p ) << 16;
515		- apaint->u.linear_gradient.p1.y = FT_NEXT_SHORT( p ) << 16;
516		- apaint->u.linear_gradient.p2.x = FT_NEXT_SHORT( p ) << 16;
517		- apaint->u.linear_gradient.p2.y = FT_NEXT_SHORT( p ) << 16;
	513	+ apaint->u.linear_gradient.p0.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	514	+ apaint->u.linear_gradient.p0.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	515	+ apaint->u.linear_gradient.p1.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	516	+ apaint->u.linear_gradient.p1.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	517	+ apaint->u.linear_gradient.p2.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	518	+ apaint->u.linear_gradient.p2.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
518	519
519	520	return 1;
520	521	}
...	...	@@ -525,13 +526,13 @@
525	526	&apaint->u.radial_gradient.colorline ) )
526	527	return 0;
527	528
528		- apaint->u.radial_gradient.c0.x = FT_NEXT_SHORT( p ) << 16;
529		- apaint->u.radial_gradient.c0.y = FT_NEXT_SHORT( p ) << 16;
	529	+ apaint->u.radial_gradient.c0.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	530	+ apaint->u.radial_gradient.c0.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
530	531
531	532	apaint->u.radial_gradient.r0 = FT_NEXT_USHORT( p ) << 16;
532	533
533		- apaint->u.radial_gradient.c1.x = FT_NEXT_SHORT( p ) << 16;
534		- apaint->u.radial_gradient.c1.y = FT_NEXT_SHORT( p ) << 16;
	534	+ apaint->u.radial_gradient.c1.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	535	+ apaint->u.radial_gradient.c1.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
535	536
536	537	apaint->u.radial_gradient.r1 = FT_NEXT_USHORT( p ) << 16;
537	538
...	...	@@ -544,11 +545,15 @@
544	545	&apaint->u.sweep_gradient.colorline ) )
545	546	return 0;
546	547
547		- apaint->u.sweep_gradient.center.x = FT_NEXT_SHORT( p ) << 16;
548		- apaint->u.sweep_gradient.center.y = FT_NEXT_SHORT( p ) << 16;
	548	+ apaint->u.sweep_gradient.center.x =
	549	+ INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	550	+ apaint->u.sweep_gradient.center.y =
	551	+ INT_TO_FIXED( FT_NEXT_SHORT( p ) );
549	552
550		- apaint->u.sweep_gradient.start_angle = FT_NEXT_SHORT( p ) << 2;
551		- apaint->u.sweep_gradient.end_angle = FT_NEXT_SHORT( p ) << 2;
	553	+ apaint->u.sweep_gradient.start_angle =
	554	+ F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
	555	+ apaint->u.sweep_gradient.end_angle =
	556	+ F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
552	557
553	558	return 1;
554	559	}
...	...	@@ -591,8 +596,8 @@
591	596	apaint->u.translate.paint.p = child_table_p;
592	597	apaint->u.translate.paint.insert_root_transform = 0;
593	598
594		- apaint->u.translate.dx = FT_NEXT_SHORT( p ) << 16;
595		- apaint->u.translate.dy = FT_NEXT_SHORT( p ) << 16;
	599	+ apaint->u.translate.dx = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	600	+ apaint->u.translate.dy = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
596	601
597	602	return 1;
598	603	}
...	...	@@ -610,14 +615,14 @@
610	615	apaint->u.scale.paint.insert_root_transform = 0;
611	616
612	617	/* All scale paints get at least one scale value. */
613		- apaint->u.scale.scale_x = FT_NEXT_SHORT( p ) << 2;
	618	+ apaint->u.scale.scale_x = F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
614	619
615	620	/* Non-uniform ones read an extra y value. */
616	621	if ( apaint->format ==
617	622	FT_COLR_PAINTFORMAT_SCALE ||
618	623	(FT_PaintFormat_Internal)apaint->format ==
619	624	FT_COLR_PAINTFORMAT_INTERNAL_SCALE_CENTER )
620		- apaint->u.scale.scale_y = FT_NEXT_SHORT( p ) << 2;
	625	+ apaint->u.scale.scale_y = F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
621	626	else
622	627	apaint->u.scale.scale_y = apaint->u.scale.scale_x;
623	628
...	...	@@ -628,8 +633,8 @@
628	633	(FT_PaintFormat_Internal)apaint->format ==
629	634	FT_COLR_PAINTFORMAT_INTERNAL_SCALE_UNIFORM_CENTER )
630	635	{
631		- apaint->u.scale.center_x = FT_NEXT_SHORT ( p ) << 16;
632		- apaint->u.scale.center_y = FT_NEXT_SHORT ( p ) << 16;
	636	+ apaint->u.scale.center_x = INT_TO_FIXED( FT_NEXT_SHORT ( p ) );
	637	+ apaint->u.scale.center_y = INT_TO_FIXED( FT_NEXT_SHORT ( p ) );
633	638	}
634	639	else
635	640	{
...	...	@@ -651,17 +656,13 @@
651	656	apaint->u.rotate.paint.p = child_table_p;
652	657	apaint->u.rotate.paint.insert_root_transform = 0;
653	658
654		- /* The angle is specified as F2DOT14 and our output type is an FT_Fixed,
655		- * shift by 2 positions. */
656		- apaint->u.rotate.angle = FT_NEXT_SHORT( p ) << 2;
	659	+ apaint->u.rotate.angle = F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
657	660
658	661	if ( (FT_PaintFormat_Internal)apaint->format ==
659	662	FT_COLR_PAINTFORMAT_INTERNAL_ROTATE_CENTER )
660	663	{
661		- /* The center is specified as Int16 in font units, shift by 16 bits to
662		- * convert to our FT_Fixed output type. */
663		- apaint->u.rotate.center_x = FT_NEXT_SHORT( p ) << 16;
664		- apaint->u.rotate.center_y = FT_NEXT_SHORT( p ) << 16;
	664	+ apaint->u.rotate.center_x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	665	+ apaint->u.rotate.center_y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
665	666	}
666	667	else
667	668	{
...	...	@@ -681,14 +682,14 @@
681	682	apaint->u.skew.paint.p = child_table_p;
682	683	apaint->u.skew.paint.insert_root_transform = 0;
683	684
684		- apaint->u.skew.x_skew_angle = FT_NEXT_SHORT( p ) << 2;
685		- apaint->u.skew.y_skew_angle = FT_NEXT_SHORT( p ) << 2;
	685	+ apaint->u.skew.x_skew_angle = F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
	686	+ apaint->u.skew.y_skew_angle = F2DOT14_TO_FIXED( FT_NEXT_SHORT( p ) );
686	687
687	688	if ( (FT_PaintFormat_Internal)apaint->format ==
688	689	FT_COLR_PAINTFORMAT_INTERNAL_SKEW_CENTER )
689	690	{
690		- apaint->u.skew.center_x = FT_NEXT_SHORT( p ) << 16;
691		- apaint->u.skew.center_y = FT_NEXT_SHORT( p ) << 16;
	691	+ apaint->u.skew.center_x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	692	+ apaint->u.skew.center_y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
692	693	}
693	694	else
694	695	{
...	...	@@ -1094,9 +1095,9 @@
1094	1095	if ( face->root.internal->transform_flags & 2 )
1095	1096	{
1096	1097	paint->u.transform.affine.dx =
1097		- face->root.internal->transform_delta.x << 10;
	1098	+ face->root.internal->transform_delta.x * ( 1 << 10 );
1098	1099	paint->u.transform.affine.dy =
1099		- face->root.internal->transform_delta.y << 10;
	1100	+ face->root.internal->transform_delta.y * ( 1 << 10 );
1100	1101	}
1101	1102	else
1102	1103	{

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.