freetype/SOURCES/freetype-2.10.4-cve-2025-27363.patch

135 lines
4.5 KiB
Diff

--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -972,7 +972,7 @@
if ( !IS_DEFAULT_INSTANCE( FT_FACE( loader->face ) ) )
{
- if ( FT_NEW_ARRAY( unrounded, n_points ) )
+ if ( FT_QNEW_ARRAY( unrounded, n_points ) )
goto Exit;
/* Deltas apply to the unscaled data. */
@@ -1941,33 +1941,25 @@
if ( FT_IS_NAMED_INSTANCE( FT_FACE( face ) ) ||
FT_IS_VARIATION( FT_FACE( face ) ) )
{
- short i, limit;
+ FT_UShort i, limit;
FT_SubGlyph subglyph;
- FT_Outline outline;
- FT_Vector* points = NULL;
- char* tags = NULL;
- short* contours = NULL;
+ FT_Outline outline = { 0, 0, NULL, NULL, NULL, 0 };
FT_Vector* unrounded = NULL;
- limit = (short)gloader->current.num_subglyphs;
+ limit = (FT_UShort)gloader->current.num_subglyphs;
/* construct an outline structure for */
/* communication with `TT_Vary_Apply_Glyph_Deltas' */
- outline.n_points = (short)( gloader->current.num_subglyphs + 4 );
- outline.n_contours = outline.n_points;
-
- outline.points = NULL;
- outline.tags = NULL;
- outline.contours = NULL;
-
- if ( FT_NEW_ARRAY( points, outline.n_points ) ||
- FT_NEW_ARRAY( tags, outline.n_points ) ||
- FT_NEW_ARRAY( contours, outline.n_points ) ||
- FT_NEW_ARRAY( unrounded, outline.n_points ) )
+ if ( FT_QNEW_ARRAY( outline.points, limit + 4 ) ||
+ FT_QNEW_ARRAY( outline.tags, limit ) ||
+ FT_QNEW_ARRAY( outline.contours, limit ) ||
+ FT_QNEW_ARRAY( unrounded, limit + 4 ) )
goto Exit1;
+ outline.n_contours = outline.n_points = limit;
+
subglyph = gloader->current.subglyphs;
for ( i = 0; i < limit; i++, subglyph++ )
@@ -1975,38 +1967,16 @@
/* applying deltas for anchor points doesn't make sense, */
/* but we don't have to specially check this since */
/* unused delta values are zero anyways */
- points[i].x = subglyph->arg1;
- points[i].y = subglyph->arg2;
- tags[i] = 1;
- contours[i] = i;
+ outline.points[i].x = subglyph->arg1;
+ outline.points[i].y = subglyph->arg2;
+ outline.tags[i] = ON_CURVE_POINT;
+ outline.contours[i] = i;
}
- points[i].x = loader->pp1.x;
- points[i].y = loader->pp1.y;
- tags[i] = 1;
- contours[i] = i;
-
- i++;
- points[i].x = loader->pp2.x;
- points[i].y = loader->pp2.y;
- tags[i] = 1;
- contours[i] = i;
-
- i++;
- points[i].x = loader->pp3.x;
- points[i].y = loader->pp3.y;
- tags[i] = 1;
- contours[i] = i;
-
- i++;
- points[i].x = loader->pp4.x;
- points[i].y = loader->pp4.y;
- tags[i] = 1;
- contours[i] = i;
-
- outline.points = points;
- outline.tags = tags;
- outline.contours = contours;
+ outline.points[i++] = loader->pp1;
+ outline.points[i++] = loader->pp2;
+ outline.points[i++] = loader->pp3;
+ outline.points[i ] = loader->pp4;
/* this call provides additional offsets */
/* for each component's translation */
@@ -2024,20 +1994,20 @@
{
if ( subglyph->flags & ARGS_ARE_XY_VALUES )
{
- subglyph->arg1 = (FT_Int16)points[i].x;
- subglyph->arg2 = (FT_Int16)points[i].y;
+ subglyph->arg1 = (FT_Int16)outline.points[i].x;
+ subglyph->arg2 = (FT_Int16)outline.points[i].y;
}
}
- loader->pp1.x = points[i + 0].x;
- loader->pp1.y = points[i + 0].y;
- loader->pp2.x = points[i + 1].x;
- loader->pp2.y = points[i + 1].y;
-
- loader->pp3.x = points[i + 2].x;
- loader->pp3.y = points[i + 2].y;
- loader->pp4.x = points[i + 3].x;
- loader->pp4.y = points[i + 3].y;
+ loader->pp1.x = outline.points[i + 0].x;
+ loader->pp1.y = outline.points[i + 0].y;
+ loader->pp2.x = outline.points[i + 1].x;
+ loader->pp2.y = outline.points[i + 1].y;
+
+ loader->pp3.x = outline.points[i + 2].x;
+ loader->pp3.y = outline.points[i + 2].y;
+ loader->pp4.x = outline.points[i + 3].x;
+ loader->pp4.y = outline.points[i + 3].y;
/* recalculate linear horizontal and vertical advances */
/* if we don't have HVAR and VVAR, respectively */