*** empty log message ***

8 files changed, 64 insertions, 24 deletions

diff --git a/src/freetype2/pfr/pfrcmap.c b/src/freetype2/pfr/pfrcmap.c
index c8faee0..9c8f9ed 100644
--- a/src/freetype2/pfr/pfrcmap.c
+++ b/src/freetype2/pfr/pfrcmap.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR cmap handling (body).                                   */
 /*                                                                         */
-/*  Copyright 2002, 2007 by                                                */
+/*  Copyright 2002, 2007, 2009 by                                          */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -18,7 +18,8 @@
 
 #include "pfrcmap.h"
 #include "pfrobjs.h"
-#include FT_INTERNAL_DEBUG_H
+
+#include "pfrerror.h"
 
 
   FT_CALLBACK_DEF( FT_Error )
@@ -87,7 +88,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   pfr_cmap_char_next( PFR_CMap    cmap,
                       FT_UInt32  *pchar_code )
   {
@@ -156,7 +157,9 @@
     (FT_CMap_InitFunc)     pfr_cmap_init,
     (FT_CMap_DoneFunc)     pfr_cmap_done,
     (FT_CMap_CharIndexFunc)pfr_cmap_char_index,
-    (FT_CMap_CharNextFunc) pfr_cmap_char_next
+    (FT_CMap_CharNextFunc) pfr_cmap_char_next,
+
+    NULL, NULL, NULL, NULL, NULL
   };
 
 
diff --git a/src/freetype2/pfr/pfrdrivr.c b/src/freetype2/pfr/pfrdrivr.c
index 4020672..15cca98 100644
--- a/src/freetype2/pfr/pfrdrivr.c
+++ b/src/freetype2/pfr/pfrdrivr.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR driver interface (body).                                */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2006 by                                    */
+/*  Copyright 2002, 2003, 2004, 2006, 2008 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -66,10 +66,16 @@
                    FT_Pos   *anadvance )
   {
     PFR_Face  face  = (PFR_Face)pfrface;
-    FT_Error  error = PFR_Err_Bad_Argument;
+    FT_Error  error = PFR_Err_Invalid_Argument;
 
 
     *anadvance = 0;
+
+    if ( !gindex )
+      goto Exit;
+
+    gindex--;
+
     if ( face )
     {
       PFR_PhyFont  phys = &face->phy_font;
@@ -82,6 +88,7 @@
       }
     }
 
+  Exit:
     return error;
   }
 
diff --git a/src/freetype2/pfr/pfrdrivr.h b/src/freetype2/pfr/pfrdrivr.h
index 36f1205..da0a1aa 100644
--- a/src/freetype2/pfr/pfrdrivr.h
+++ b/src/freetype2/pfr/pfrdrivr.h
@@ -26,6 +26,10 @@
 
 FT_BEGIN_HEADER
 
+#ifdef FT_CONFIG_OPTION_PIC
+#error "this module does not support PIC yet"
+#endif 
+
 
   FT_EXPORT_VAR( const FT_Driver_ClassRec )  pfr_driver_class;
 
diff --git a/src/freetype2/pfr/pfrgload.c b/src/freetype2/pfr/pfrgload.c
index 3bb1733..6fe6e42 100644
--- a/src/freetype2/pfr/pfrgload.c
+++ b/src/freetype2/pfr/pfrgload.c
@@ -595,7 +595,7 @@
 
     if ( org_count + count > glyph->max_subs )
     {
-      FT_UInt  new_max = ( org_count + count + 3 ) & -4;
+      FT_UInt  new_max = ( org_count + count + 3 ) & (FT_UInt)-4;
 
 
       if ( FT_RENEW_ARRAY( glyph->subs, glyph->max_subs, new_max ) )
diff --git a/src/freetype2/pfr/pfrload.c b/src/freetype2/pfr/pfrload.c
index 1ee2c1f..bc5c035 100644
--- a/src/freetype2/pfr/pfrload.c
+++ b/src/freetype2/pfr/pfrload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR loader (body).                                          */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2007 by                              */
+/*  Copyright 2002, 2003, 2004, 2005, 2007, 2009 by                        */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -428,7 +428,8 @@
 
   Too_Short:
     error = PFR_Err_Invalid_Table;
-    FT_ERROR(( "pfr_extra_item_load_bitmap_info: invalid bitmap info table\n" ));
+    FT_ERROR(( "pfr_extra_item_load_bitmap_info:"
+               " invalid bitmap info table\n" ));
     goto Exit;
   }
 
@@ -506,7 +507,8 @@
 
   Too_Short:
     error = PFR_Err_Invalid_Table;
-    FT_ERROR(( "pfr_exta_item_load_stem_snaps: invalid stem snaps table\n" ));
+    FT_ERROR(( "pfr_exta_item_load_stem_snaps:"
+               " invalid stem snaps table\n" ));
     goto Exit;
   }
 
@@ -603,8 +605,8 @@
     FT_FREE( item );
 
     error = PFR_Err_Invalid_Table;
-    FT_ERROR(( "pfr_extra_item_load_kerning_pairs: "
-               "invalid kerning pairs table\n" ));
+    FT_ERROR(( "pfr_extra_item_load_kerning_pairs:"
+               " invalid kerning pairs table\n" ));
     goto Exit;
   }
 
@@ -714,7 +716,8 @@
   {
     FT_Error   error;
     FT_Memory  memory = stream->memory;
-    FT_UInt    flags, num_aux;
+    FT_UInt    flags;
+    FT_ULong   num_aux;
     FT_Byte*   p;
     FT_Byte*   limit;
 
diff --git a/src/freetype2/pfr/pfrobjs.c b/src/freetype2/pfr/pfrobjs.c
index 180446d..56d617d 100644
--- a/src/freetype2/pfr/pfrobjs.c
+++ b/src/freetype2/pfr/pfrobjs.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR object methods (body).                                  */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007 by                        */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -41,10 +41,15 @@
   FT_LOCAL_DEF( void )
   pfr_face_done( FT_Face  pfrface )     /* PFR_Face */
   {
-    PFR_Face   face   = (PFR_Face)pfrface;
-    FT_Memory  memory = pfrface->driver->root.memory;
+    PFR_Face   face = (PFR_Face)pfrface;
+    FT_Memory  memory;
 
 
+    if ( !face )
+      return;
+
+    memory = pfrface->driver->root.memory;
+
     /* we don't want dangling pointers */
     pfrface->family_name = NULL;
     pfrface->style_name  = NULL;
diff --git a/src/freetype2/pfr/pfrsbit.c b/src/freetype2/pfr/pfrsbit.c
index 45ff666..8a38bec 100644
--- a/src/freetype2/pfr/pfrsbit.c
+++ b/src/freetype2/pfr/pfrsbit.c
@@ -630,18 +630,35 @@
                                        &xpos, &ypos,
                                        &xsize, &ysize,
                                        &advance, &format );
+
+      /*
+       * XXX: on 16bit system, we return an error for huge bitmap
+       *      which causes a size truncation, because truncated
+       *      size properties makes bitmap glyph broken.
+       */
+      if ( xpos > FT_INT_MAX || ( ypos + ysize ) > FT_INT_MAX )
+      {
+        FT_TRACE1(( "pfr_slot_load_bitmap:" ));
+        FT_TRACE1(( "huge bitmap glyph %dx%d over FT_GlyphSlot\n",
+                     xpos, ypos ));
+        error = PFR_Err_Invalid_Pixel_Size;
+      }
+
       if ( !error )
       {
         glyph->root.format = FT_GLYPH_FORMAT_BITMAP;
 
         /* Set up glyph bitmap and metrics */
+
+        /* XXX: needs casts to fit FT_Bitmap.{width|rows|pitch} */
         glyph->root.bitmap.width      = (FT_Int)xsize;
         glyph->root.bitmap.rows       = (FT_Int)ysize;
-        glyph->root.bitmap.pitch      = (FT_Long)( xsize + 7 ) >> 3;
+        glyph->root.bitmap.pitch      = (FT_Int)( xsize + 7 ) >> 3;
         glyph->root.bitmap.pixel_mode = FT_PIXEL_MODE_MONO;
 
-        glyph->root.metrics.width        = (FT_Long)xsize << 6;
-        glyph->root.metrics.height       = (FT_Long)ysize << 6;
+        /* XXX: needs casts to fit FT_Glyph_Metrics.{width|height} */
+        glyph->root.metrics.width        = (FT_Pos)xsize << 6;
+        glyph->root.metrics.height       = (FT_Pos)ysize << 6;
         glyph->root.metrics.horiBearingX = xpos << 6;
         glyph->root.metrics.horiBearingY = ypos << 6;
         glyph->root.metrics.horiAdvance  = FT_PIX_ROUND( ( advance >> 2 ) );
@@ -649,8 +666,9 @@
         glyph->root.metrics.vertBearingY = 0;
         glyph->root.metrics.vertAdvance  = size->root.metrics.height;
 
-        glyph->root.bitmap_left = xpos;
-        glyph->root.bitmap_top  = ypos + ysize;
+        /* XXX: needs casts fit FT_GlyphSlotRec.bitmap_{left|top} */
+        glyph->root.bitmap_left = (FT_Int)xpos;
+        glyph->root.bitmap_top  = (FT_Int)(ypos + ysize);
 
         /* Allocate and read bitmap data */
         {
diff --git a/src/freetype2/pfr/pfrtypes.h b/src/freetype2/pfr/pfrtypes.h
index c0ae042..9183108 100644
--- a/src/freetype2/pfr/pfrtypes.h
+++ b/src/freetype2/pfr/pfrtypes.h
@@ -200,7 +200,7 @@ FT_BEGIN_HEADER
     FT_Byte       flags;
     FT_Short      base_adj;
     FT_UInt       pair_size;
-    FT_UInt32     offset;
+    FT_Offset     offset;
     FT_UInt32     pair1;
     FT_UInt32     pair2;
 
@@ -252,7 +252,7 @@ FT_BEGIN_HEADER
     FT_UInt            blue_scale;
 
     FT_UInt            num_chars;
-    FT_UInt32          chars_offset;
+    FT_Offset          chars_offset;
     PFR_Char           chars;
 
     FT_UInt            num_kern_pairs;
@@ -260,7 +260,7 @@ FT_BEGIN_HEADER
     PFR_KernItem*      kern_items_tail;
 
     /* not part of the spec, but used during load */
-    FT_UInt32          bct_offset;
+    FT_Long            bct_offset;
     FT_Byte*           cursor;
 
   } PFR_PhyFontRec, *PFR_PhyFont;