[Git][freetype/freetype][master] 2 commits: [truetype] In `ItemVariation

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

9be958ca

by Behdad Esfahbod at 2022-11-12T16:41:20+01:00

[truetype] In `ItemVariationStore`, value 0xFFFF for `dataCount` is valid.

It corresponds to outer indices of 0 to 0xFFFE.

* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Remove invalid
code.

e97cb9e8

by Behdad Esfahbod at 2022-11-12T16:45:44+01:00

[truetype] Improve bounds checks for `ItemVariationStore`.

* src/truetype/ttgxvar.c (tt_hvadvance_adjust): Move bounds check ...
(tt_var_get_item_delta): ...  to this function, because it is safer.  For
example, the 'avar' table 2.0 codepath was not performing a bounds check at
all.

1 changed file:

src/truetype/ttgxvar.c

Changes:

src/truetype/ttgxvar.c

@@ -525,16 +525,6 @@
        goto Exit;
+     }
 -    /* new in OpenType 1.8.4: inner & outer index equal to 0xFFFF    */
 -    /* has a special meaning (i.e., no variation data for this item) */
 -    if ( itemStore->dataCount == 0xFFFFU )
 -    {
 -      FT_TRACE2(( "ft_var_load_item_variation_store:"
 -                  " dataCount too large\n" ));
 -      error = FT_THROW( Invalid_Table );
 -      goto Exit;
 -    }
+-
      /* make temporary copy of item variation data offsets; */
      /* we will parse region list first, then come back     */
      if ( FT_QNEW_ARRAY( dataOffsetArray, itemStore->dataCount ) )
@@ -1006,10 +996,16 @@
      /* See pseudo code from `Font Variations Overview' */
      /* in the OpenType specification.                  */
 +    if ( outerIndex >= itemStore->dataCount )
 +      return 0; /* Out of range. */
++
      varData  = &itemStore->varData[outerIndex];
      deltaSet = FT_OFFSET( varData->deltaSet,
                            varData->regionIdxCount * innerIndex );
 +    if ( innerIndex >= varData->itemCount )
 +      return 0; /* Out of range. */
++
      if ( FT_QNEW_ARRAY( scalars, varData->regionIdxCount ) )
        return 0;
@@ -1181,20 +1177,9 @@
+     }
      else
+     {
 -      GX_ItemVarData  varData;
+-
+-
        /* no widthMap data */
        outerIndex = 0;
        innerIndex = gindex;
+-
 -      varData = &table->itemStore.varData[outerIndex];
 -      if ( gindex >= varData->itemCount )
 -      {
 -        FT_TRACE2(( "gindex %d out of range\n", gindex ));
 -        error = FT_THROW( Invalid_Argument );
 -        goto Exit;
 -      }
+     }
      delta = tt_var_get_item_delta( face,

From:	Werner Lemberg (@wl)
Subject:	[Git][freetype/freetype][master] 2 commits: [truetype] In `ItemVariationStore`, value 0xFFFF for `dataCount` is valid.
Date:	Sat, 12 Nov 2022 15:48:09 +0000