merged freetype 2.4.2

git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@37947 a95241bf-73f2-0310-859d-f6bbb57e9c96

headers/libs/freetype2/freetype/config/ftconfig.h

@@ -363,7 +363,7 @@ FT_BEGIN_HEADER
 
 #endif /* __arm__ && !__thumb__ && !( __CC_ARM || __ARMCC__ ) */
 
-#if defined( i386 )
+#if defined( __i386__ )
 #define FT_MULFIX_ASSEMBLER  FT_MulFix_i386
 
   /* documentation is in freetype.h */

headers/libs/freetype2/freetype/config/ftoption.h

@@ -489,8 +489,7 @@ FT_BEGIN_HEADER
   /*************************************************************************/
   /*                                                                       */
   /* Define TT_CONFIG_OPTION_BYTECODE_INTERPRETER if you want to compile   */
-  /* a bytecode interpreter in the TrueType driver.  Note that there are   */
+  /* a bytecode interpreter in the TrueType driver.                        */
-  /* important patent issues related to the use of the interpreter.        */
   /*                                                                       */
   /* By undefining this, you will only compile the code necessary to load  */
   /* TrueType glyphs without hinting.                                      */
@@ -504,10 +503,13 @@ FT_BEGIN_HEADER
   /*                                                                       */
   /* If you define TT_CONFIG_OPTION_UNPATENTED_HINTING, a special version  */
   /* of the TrueType bytecode interpreter is used that doesn't implement   */
-  /* any of the patented opcodes and algorithms.  Note that the            */
+  /* any of the patented opcodes and algorithms.  The patents related to   */
-  /* TT_CONFIG_OPTION_UNPATENTED_HINTING macro is *ignored* if you define  */
+  /* TrueType hinting have expired worldwide since May 2010; this option   */
-  /* TT_CONFIG_OPTION_BYTECODE_INTERPRETER; in other words, either define  */
+  /* is now deprecated.                                                    */
-  /* TT_CONFIG_OPTION_BYTECODE_INTERPRETER or                              */
+  /*                                                                       */
+  /* Note that the TT_CONFIG_OPTION_UNPATENTED_HINTING macro is *ignored*  */
+  /* if you define TT_CONFIG_OPTION_BYTECODE_INTERPRETER; in other words,  */
+  /* either define TT_CONFIG_OPTION_BYTECODE_INTERPRETER or                */
   /* TT_CONFIG_OPTION_UNPATENTED_HINTING but not both at the same time.    */
   /*                                                                       */
   /* This macro is only useful for a small number of font files (mostly    */
@@ -544,7 +546,7 @@ FT_BEGIN_HEADER
   /*     ...                                                               */
   /*   }                                                                   */
   /*                                                                       */
-#define TT_CONFIG_OPTION_UNPATENTED_HINTING
+/* #define TT_CONFIG_OPTION_UNPATENTED_HINTING */
 
 
   /*************************************************************************/
@@ -690,6 +692,27 @@ FT_BEGIN_HEADER
 #define FT_CONFIG_OPTION_OLD_INTERNALS
 
 
+  /*
+   *  To detect legacy cache-lookup call from a rogue client (<= 2.1.7),
+   *  we restrict the number of charmaps in a font.  The current API of
+   *  FTC_CMapCache_Lookup() takes cmap_index & charcode, but old API
+   *  takes charcode only.  To determine the passed value is for cmap_index
+   *  or charcode, the possible cmap_index is restricted not to exceed
+   *  the minimum possible charcode by a rogue client.  It is also very
+   *  unlikely that a rogue client is interested in Unicode values 0 to 15.
+   *
+   *  NOTE: The original threshold was 4 deduced from popular number of
+   *        cmap subtables in UCS-4 TrueType fonts, but now it is not
+   *        irregular for OpenType fonts to have more than 4 subtables,
+   *        because variation selector subtables are available for Apple
+   *        and Microsoft platforms.
+   */
+
+#ifdef FT_CONFIG_OPTION_OLD_INTERNALS
+#define FT_MAX_CHARMAP_CACHEABLE 15
+#endif
+
+
   /*
    * This macro is defined if either unpatented or native TrueType
    * hinting is requested by the definitions above.

headers/libs/freetype2/freetype/freetype.h

@@ -1952,6 +1952,9 @@ FT_BEGIN_HEADER
   /*    Each new face object created with this function also owns a        */
   /*    default @FT_Size object, accessible as `face->size'.               */
   /*                                                                       */
+  /*    See the discussion of reference counters in the description of     */
+  /*    @FT_Reference_Face.                                                */
+  /*                                                                       */
   FT_EXPORT( FT_Error )
   FT_Open_Face( FT_Library           library,
                 const FT_Open_Args*  args,
@@ -2016,6 +2019,33 @@ FT_BEGIN_HEADER
                     FT_Open_Args*  parameters );
 
 
+  /*************************************************************************/
+  /*                                                                       */
+  /* <Function>                                                            */
+  /*    FT_Reference_Face                                                  */
+  /*                                                                       */
+  /* <Description>                                                         */
+  /*    A counter gets initialized to~1 at the time an @FT_Face structure  */
+  /*    is created.  This function increments the counter.  @FT_Done_Face  */
+  /*    then only destroys a face if the counter is~1, otherwise it simply */
+  /*    decrements the counter.                                            */
+  /*                                                                       */
+  /*    This function helps in managing life-cycles of structures which    */
+  /*    reference @FT_Face objects.                                        */
+  /*                                                                       */
+  /* <Input>                                                               */
+  /*    face :: A handle to a target face object.                          */
+  /*                                                                       */
+  /* <Return>                                                              */
+  /*    FreeType error code.  0~means success.                             */
+  /*                                                                       */
+  /* <Since>                                                               */
+  /*    2.4.2                                                              */
+  /*                                                                       */
+  FT_EXPORT( FT_Error )
+  FT_Reference_Face( FT_Face  face );
+
+
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
@@ -2031,6 +2061,10 @@ FT_BEGIN_HEADER
   /* <Return>                                                              */
   /*    FreeType error code.  0~means success.                             */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    See the discussion of reference counters in the description of     */
+  /*    @FT_Reference_Face.                                                */
+  /*                                                                       */
   FT_EXPORT( FT_Error )
   FT_Done_Face( FT_Face  face );
 
@@ -2997,7 +3031,7 @@ FT_BEGIN_HEADER
    *
    * @return:
    *   The index into the array of character maps within the face to which
-   *   `charmap' belongs.
+   *   `charmap' belongs.  If an error occurs, -1 is returned.
    *
    */
   FT_EXPORT( FT_Int )
@@ -3773,8 +3807,8 @@ FT_BEGIN_HEADER
    *
    */
 #define FREETYPE_MAJOR  2
-#define FREETYPE_MINOR  3
+#define FREETYPE_MINOR  4
-#define FREETYPE_PATCH  12
+#define FREETYPE_PATCH  2
 
 
   /*************************************************************************/
@@ -3834,6 +3868,9 @@ FT_BEGIN_HEADER
   /*    1~if this is a TrueType font that uses one of the patented         */
   /*    opcodes, 0~otherwise.                                              */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    Since May 2010, TrueType hinting is no longer patented.            */
+  /*                                                                       */
   /* <Since>                                                               */
   /*    2.3.5                                                              */
   /*                                                                       */
@@ -3861,6 +3898,9 @@ FT_BEGIN_HEADER
   /*    an SFNT font, or if the unpatented hinter is not compiled in this  */
   /*    instance of the library.                                           */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    Since May 2010, TrueType hinting is no longer patented.            */
+  /*                                                                       */
   /* <Since>                                                               */
   /*    2.3.5                                                              */
   /*                                                                       */

headers/libs/freetype2/freetype/ftcache.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType Cache subsystem (specification).                            */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -263,10 +263,10 @@ FT_BEGIN_HEADER
   /*    reference-counted.  A node with a count of~0 might be flushed      */
   /*    out of a full cache whenever a lookup request is performed.        */
   /*                                                                       */
-  /*    If you lookup nodes, you have the ability to `acquire' them, i.e., */
+  /*    If you look up nodes, you have the ability to `acquire' them,      */
-  /*    to increment their reference count.  This will prevent the node    */
+  /*    i.e., to increment their reference count.  This will prevent the   */
-  /*    from being flushed out of the cache until you explicitly `release' */
+  /*    node from being flushed out of the cache until you explicitly      */
-  /*    it (see @FTC_Node_Unref).                                          */
+  /*    `release' it (see @FTC_Node_Unref).                                */
   /*                                                                       */
   /*    See also @FTC_SBitCache_Lookup and @FTC_ImageCache_Lookup.         */
   /*                                                                       */

headers/libs/freetype2/freetype/fterrdef.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType error codes (specification).                                */
 /*                                                                         */
-/*  Copyright 2002, 2004, 2006, 2007 by                                    */
+/*  Copyright 2002, 2004, 2006, 2007, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -211,6 +211,9 @@
                 "argument stack underflow" )
   FT_ERRORDEF_( Ignore,                                      0xA2, \
                 "ignore" )
+  FT_ERRORDEF_( No_Unicode_Glyph_Name,                       0xA3, \
+                "no Unicode glyph name found" )
+
 
   /* BDF errors */
 
@@ -220,19 +223,21 @@
                 "`FONT' field missing" )
   FT_ERRORDEF_( Missing_Size_Field,                          0xB2, \
                 "`SIZE' field missing" )
-  FT_ERRORDEF_( Missing_Chars_Field,                         0xB3, \
+  FT_ERRORDEF_( Missing_Fontboundingbox_Field,               0xB3, \
+                "`FONTBOUNDINGBOX' field missing" )
+  FT_ERRORDEF_( Missing_Chars_Field,                         0xB4, \
                 "`CHARS' field missing" )
-  FT_ERRORDEF_( Missing_Startchar_Field,                     0xB4, \
+  FT_ERRORDEF_( Missing_Startchar_Field,                     0xB5, \
                 "`STARTCHAR' field missing" )
-  FT_ERRORDEF_( Missing_Encoding_Field,                      0xB5, \
+  FT_ERRORDEF_( Missing_Encoding_Field,                      0xB6, \
                 "`ENCODING' field missing" )
-  FT_ERRORDEF_( Missing_Bbx_Field,                           0xB6, \
+  FT_ERRORDEF_( Missing_Bbx_Field,                           0xB7, \
                 "`BBX' field missing" )
-  FT_ERRORDEF_( Bbx_Too_Big,                                 0xB7, \
+  FT_ERRORDEF_( Bbx_Too_Big,                                 0xB8, \
                 "`BBX' too big" )
-  FT_ERRORDEF_( Corrupted_Font_Header,                       0xB8, \
+  FT_ERRORDEF_( Corrupted_Font_Header,                       0xB9, \
                 "Font header corrupted or missing fields" )
-  FT_ERRORDEF_( Corrupted_Font_Glyphs,                       0xB9, \
+  FT_ERRORDEF_( Corrupted_Font_Glyphs,                       0xBA, \
                 "Font glyphs corrupted or missing fields" )
 
 

headers/libs/freetype2/freetype/ftlcdfil.h

@@ -5,7 +5,7 @@
 /*    FreeType API for color filtering of subpixel bitmap glyphs           */
 /*    (specification).                                                     */
 /*                                                                         */
-/*  Copyright 2006, 2007, 2008 by                                          */
+/*  Copyright 2006, 2007, 2008, 2010 by                                    */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -58,7 +58,7 @@ FT_BEGIN_HEADER
 
   /****************************************************************************
    *
-   * @func:
+   * @enum:
    *   FT_LcdFilter
    *
    * @description:
@@ -161,6 +161,47 @@ FT_BEGIN_HEADER
   FT_Library_SetLcdFilter( FT_Library    library,
                            FT_LcdFilter  filter );
 
+
+  /**************************************************************************
+   *
+   * @func:
+   *   FT_Library_SetLcdFilterWeights
+   *
+   * @description:
+   *   Use this function to override the filter weights selected by
+   *   @FT_Library_SetLcdFilter.  By default, FreeType uses the quintuple
+   *   (0x00, 0x55, 0x56, 0x55, 0x00) for FT_LCD_FILTER_LIGHT, and (0x10,
+   *   0x40, 0x70, 0x40, 0x10) for FT_LCD_FILTER_DEFAULT and
+   *   FT_LCD_FILTER_LEGACY.
+   *
+   * @input:
+   *   library ::
+   *     A handle to the target library instance.
+   *
+   *   weights ::
+   *     A pointer to an array; the function copies the first five bytes and
+   *     uses them to specify the filter weights.
+   *
+   * @return:
+   *   FreeType error code.  0~means success.
+   *
+   * @note:
+   *   Due to *PATENTS* covering subpixel rendering, this function doesn't
+   *   do anything except returning `FT_Err_Unimplemented_Feature' if the
+   *   configuration macro FT_CONFIG_OPTION_SUBPIXEL_RENDERING is not
+   *   defined in your build of the library, which should correspond to all
+   *   default builds of FreeType.
+   *
+   *   This function must be called after @FT_Library_SetLcdFilter to have
+   *   any effect.
+   *
+   * @since:
+   *   2.4.0
+   */
+  FT_EXPORT( FT_Error )
+  FT_Library_SetLcdFilterWeights( FT_Library      library,
+                                  unsigned char  *weights );
+
   /* */
 
 

headers/libs/freetype2/freetype/ftlist.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Generic list support for FreeType (specification).                   */
 /*                                                                         */
-/*  Copyright 1996-2001, 2003, 2007 by                                     */
+/*  Copyright 1996-2001, 2003, 2007, 2010 by                               */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -255,6 +255,10 @@ FT_BEGIN_HEADER
   /*    user    :: A user-supplied field which is passed as the last       */
   /*               argument to the destructor.                             */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    This function expects that all nodes added by @FT_List_Add or      */
+  /*    @FT_List_Insert have been dynamically allocated.                   */
+  /*                                                                       */
   FT_EXPORT( void )
   FT_List_Finalize( FT_List             list,
                     FT_List_Destructor  destroy,

headers/libs/freetype2/freetype/ftmodapi.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType modules public interface (specification).                   */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2006, 2008, 2009 by                   */
+/*  Copyright 1996-2001, 2002, 2003, 2006, 2008, 2009, 2010 by             */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -249,6 +249,33 @@ FT_BEGIN_HEADER
                     FT_Module   module );
 
 
+  /*************************************************************************/
+  /*                                                                       */
+  /* <Function>                                                            */
+  /*    FT_Reference_Library                                               */
+  /*                                                                       */
+  /* <Description>                                                         */
+  /*    A counter gets initialized to~1 at the time an @FT_Library         */
+  /*    structure is created.  This function increments the counter.       */
+  /*    @FT_Done_Library then only destroys a library if the counter is~1, */
+  /*    otherwise it simply decrements the counter.                        */
+  /*                                                                       */
+  /*    This function helps in managing life-cycles of structures which    */
+  /*    reference @FT_Library objects.                                     */
+  /*                                                                       */
+  /* <Input>                                                               */
+  /*    library :: A handle to a target library object.                    */
+  /*                                                                       */
+  /* <Return>                                                              */
+  /*    FreeType error code.  0~means success.                             */
+  /*                                                                       */
+  /* <Since>                                                               */
+  /*    2.4.2                                                              */
+  /*                                                                       */
+  FT_EXPORT( FT_Error )
+  FT_Reference_Library( FT_Library  library );
+
+
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */
@@ -263,6 +290,9 @@ FT_BEGIN_HEADER
   /*    @FT_Add_Default_Modules or a series of calls to @FT_Add_Module)    */
   /*    instead of @FT_Init_FreeType to initialize the FreeType library.   */
   /*                                                                       */
+  /*    Don't use @FT_Done_FreeType but @FT_Done_Library to destroy a      */
+  /*    library instance.                                                  */
+  /*                                                                       */
   /* <Input>                                                               */
   /*    memory   :: A handle to the original memory object.                */
   /*                                                                       */
@@ -272,6 +302,10 @@ FT_BEGIN_HEADER
   /* <Return>                                                              */
   /*    FreeType error code.  0~means success.                             */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    See the discussion of reference counters in the description of     */
+  /*    @FT_Reference_Library.                                             */
+  /*                                                                       */
   FT_EXPORT( FT_Error )
   FT_New_Library( FT_Memory    memory,
                   FT_Library  *alibrary );
@@ -292,6 +326,10 @@ FT_BEGIN_HEADER
   /* <Return>                                                              */
   /*    FreeType error code.  0~means success.                             */
   /*                                                                       */
+  /* <Note>                                                                */
+  /*    See the discussion of reference counters in the description of     */
+  /*    @FT_Reference_Library.                                             */
+  /*                                                                       */
   FT_EXPORT( FT_Error )
   FT_Done_Library( FT_Library  library );
 
@@ -394,8 +432,8 @@ FT_BEGIN_HEADER
    *
    *    FT_TRUETYPE_ENGINE_TYPE_PATENTED ::
    *       The library implements a bytecode interpreter that covers
-   *       the full instruction set of the TrueType virtual machine.
+   *       the full instruction set of the TrueType virtual machine (this
-   *       See the file `docs/PATENTS' for legal aspects.
+   *       was governed by patents until May 2010, hence the name).
    *
    *  @since:
    *       2.2

headers/libs/freetype2/freetype/ftrender.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType renderer modules public interface (specification).          */
 /*                                                                         */
-/*  Copyright 1996-2001, 2005, 2006 by                                     */
+/*  Copyright 1996-2001, 2005, 2006, 2010 by                               */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -141,10 +141,6 @@ FT_BEGIN_HEADER
   /*    raster_class    :: For @FT_GLYPH_FORMAT_OUTLINE renderers only.    */
   /*                       This is a pointer to its raster's class.        */
   /*                                                                       */
-  /*    raster          :: For @FT_GLYPH_FORMAT_OUTLINE renderers only.    */
-  /*                       This is a pointer to the corresponding raster   */
-  /*                       object, if any.                                 */
-  /*                                                                       */
   typedef struct  FT_Renderer_Class_
   {
     FT_Module_Class            root;

headers/libs/freetype2/freetype/ftsystem.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType low-level system interface definition (specification).      */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2005 by                                     */
+/*  Copyright 1996-2001, 2002, 2005, 2010 by                               */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -240,7 +240,8 @@ FT_BEGIN_HEADER
    *
    * @note:
    *   This function might be called to perform a seek or skip operation
-   *   with a `count' of~0.
+   *   with a `count' of~0.  A non-zero return value then indicates an
+   *   error.
    *
    */
   typedef unsigned long
@@ -301,7 +302,7 @@ FT_BEGIN_HEADER
    *     The stream's input function.
    *
    *   close ::
-   *     The stream;s close function.
+   *     The stream's close function.
    *
    *   memory ::
    *     The memory manager to use to preload frames.  This is set

headers/libs/freetype2/freetype/internal/ftmemory.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType memory management macros (specification).               */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007 by                   */
+/*  Copyright 1996-2001, 2002, 2004, 2005, 2006, 2007, 2010 by             */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg                       */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -58,15 +58,27 @@ FT_BEGIN_HEADER
 
 
   /*
-   *  C++ refuses to handle statements like p = (void*)anything; where `p'
+   *  C++ refuses to handle statements like p = (void*)anything, with `p' a
-   *  is a typed pointer.  Since we don't have a `typeof' operator in
+   *  typed pointer.  Since we don't have a `typeof' operator in standard
-   *  standard C++, we have to use ugly casts.
+   *  C++, we have to use a template to emulate it.
    */
 
 #ifdef __cplusplus
-#define FT_ASSIGNP( p, val )  *((void**)&(p)) = (val)
+
+  extern "C++"
+  template <typename T> inline T*
+  cplusplus_typeof(        T*,
+                    void  *v )
+  {
+    return static_cast <T*> ( v );
+  }
+
+#define FT_ASSIGNP( p, val )  (p) = cplusplus_typeof( (p), (val) )
+
 #else
+
 #define FT_ASSIGNP( p, val )  (p) = (val)
+
 #endif
 
 

headers/libs/freetype2/freetype/internal/ftobjs.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType private base classes (specification).                   */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -311,6 +311,12 @@ FT_BEGIN_HEADER
   /*      in the case when the unpatented hinter is compiled within the    */
   /*      library.                                                         */
   /*                                                                       */
+  /*    refcount ::                                                        */
+  /*      A counter initialized to~1 at the time an @FT_Face structure is  */
+  /*      created.  @FT_Reference_Face increments this counter, and        */
+  /*      @FT_Done_Face only destroys a face if the counter is~1,          */
+  /*      otherwise it simply decrements it.                               */
+  /*                                                                       */
   typedef struct  FT_Face_InternalRec_
   {
 #ifdef FT_CONFIG_OPTION_OLD_INTERNALS
@@ -328,6 +334,7 @@ FT_BEGIN_HEADER
 #endif
 
     FT_Bool             ignore_unpatented_hinter;
+    FT_UInt             refcount;
 
   } FT_Face_InternalRec;
 
@@ -805,10 +812,28 @@ FT_BEGIN_HEADER
   /*                                                                       */
   /*    debug_hooks      :: XXX                                            */
   /*                                                                       */
+  /*    lcd_filter       :: If subpixel rendering is activated, the        */
+  /*                        selected LCD filter mode.                      */
+  /*                                                                       */
+  /*    lcd_extra        :: If subpixel rendering is activated, the number */
+  /*                        of extra pixels needed for the LCD filter.     */
+  /*                                                                       */
+  /*    lcd_weights      :: If subpixel rendering is activated, the LCD    */
+  /*                        filter weights, if any.                        */
+  /*                                                                       */
+  /*    lcd_filter_func  :: If subpixel rendering is activated, the LCD    */
+  /*                        filtering callback function.                   */
+  /*                                                                       */
   /*    pic_container    :: Contains global structs and tables, instead    */
   /*                        of defining them globallly.                    */
   /*                                                                       */
-
+  /*    refcount         :: A counter initialized to~1 at the time an      */
+  /*                        @FT_Library structure is created.              */
+  /*                        @FT_Reference_Library increments this counter, */
+  /*                        and @FT_Done_Library only destroys a library   */
+  /*                        if the counter is~1, otherwise it simply       */
+  /*                        decrements it.                                 */
+  /*                                                                       */
   typedef struct  FT_LibraryRec_
   {
     FT_Memory          memory;           /* library's memory manager */
@@ -843,6 +868,8 @@ FT_BEGIN_HEADER
     FT_PIC_Container   pic_container;
 #endif
 
+    FT_UInt            refcount;
+
   } FT_LibraryRec;
 
 

headers/libs/freetype2/freetype/ttnameid.h

@@ -64,7 +64,7 @@ FT_BEGIN_HEADER
    *     MacOS systems (even if they contain a Microsoft charmap as well).
    *
    *   TT_PLATFORM_ISO ::
-   *     This value was used to specify Unicode charmaps.  It is however
+   *     This value was used to specify ISO/IEC 10646 charmaps.  It is however
    *     now deprecated.  See @TT_ISO_ID_XXX for a list of corresponding
    *     `encoding_id' values.
    *

headers/libs/freetype2/freetype/tttables.h

@@ -5,7 +5,7 @@
 /*    Basic SFNT/TrueType tables definitions and interface                 */
 /*    (specification only).                                                */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2008, 2009 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2008, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -557,13 +557,13 @@ FT_BEGIN_HEADER
   /*                                                                       */
   typedef enum  FT_Sfnt_Tag_
   {
-    ft_sfnt_head = 0,
+    ft_sfnt_head = 0,    /* TT_Header     */
-    ft_sfnt_maxp = 1,
+    ft_sfnt_maxp = 1,    /* TT_MaxProfile */
-    ft_sfnt_os2  = 2,
+    ft_sfnt_os2  = 2,    /* TT_OS2        */
-    ft_sfnt_hhea = 3,
+    ft_sfnt_hhea = 3,    /* TT_HoriHeader */
-    ft_sfnt_vhea = 4,
+    ft_sfnt_vhea = 4,    /* TT_VertHeader */
-    ft_sfnt_post = 5,
+    ft_sfnt_post = 5,    /* TT_Postscript */
-    ft_sfnt_pclt = 6,
+    ft_sfnt_pclt = 6,    /* TT_PCLT       */
 
     sfnt_max   /* internal end mark */
 
@@ -590,6 +590,9 @@ FT_BEGIN_HEADER
   /*    error, or if the corresponding table was not found *OR* loaded     */
   /*    from the file.                                                     */
   /*                                                                       */
+  /*    Use a typecast according to `tag' to access the structure          */
+  /*    elements.                                                          */
+  /*                                                                       */
   /* <Note>                                                                */
   /*    The table is owned by the face object and disappears with it.      */
   /*                                                                       */

src/libs/freetype2/autofit/afcjk.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter hinting routines for CJK script (body).                  */
 /*                                                                         */
-/*  Copyright 2006, 2007, 2008, 2009 by                                    */
+/*  Copyright 2006, 2007, 2008, 2009, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -1371,7 +1371,7 @@
     FT_UNUSED( metrics );
 
 
-    error = af_glyph_hints_reload( hints, outline, 0 );
+    error = af_glyph_hints_reload( hints, outline );
     if ( error )
       goto Exit;
 

src/libs/freetype2/autofit/afglobal.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter routines to compute global hinting values (body).        */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009 by                  */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by            */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -167,8 +167,11 @@
 
       for ( nn = 0; nn < globals->glyph_count; nn++ )
       {
-        if ( gscripts[nn] == AF_SCRIPT_LIST_NONE )
+        if ( ( gscripts[nn] & ~AF_DIGIT ) == AF_SCRIPT_LIST_NONE )
-          gscripts[nn] = AF_SCRIPT_LIST_DEFAULT;
+        {
+          gscripts[nn] &= ~AF_SCRIPT_LIST_NONE;
+          gscripts[nn] |= AF_SCRIPT_LIST_DEFAULT;
+        }
       }
     }
 
@@ -183,7 +186,7 @@
   {
     FT_Error        error;
     FT_Memory       memory;
-    AF_FaceGlobals  globals;
+    AF_FaceGlobals  globals = NULL;
 
 
     memory = face->memory;

src/libs/freetype2/autofit/afhints.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter hinting routines (body).                                 */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2009 by                        */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2009, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -377,120 +377,6 @@
   }
 
 
-  /* compute all inflex points in a given glyph */
-
-  static void
-  af_glyph_hints_compute_inflections( AF_GlyphHints  hints )
-  {
-    AF_Point*  contour       = hints->contours;
-    AF_Point*  contour_limit = contour + hints->num_contours;
-
-
-    /* do each contour separately */
-    for ( ; contour < contour_limit; contour++ )
-    {
-      AF_Point  point = contour[0];
-      AF_Point  first = point;
-      AF_Point  start = point;
-      AF_Point  end   = point;
-      AF_Point  before;
-      AF_Point  after;
-      FT_Pos    in_x, in_y, out_x, out_y;
-      AF_Angle  orient_prev, orient_cur;
-      FT_Int    finished = 0;
-
-
-      /* compute first segment in contour */
-      first = point;
-
-      start = end = first;
-      do
-      {
-        end = end->next;
-        if ( end == first )
-          goto Skip;
-
-        in_x = end->fx - start->fx;
-        in_y = end->fy - start->fy;
-
-      } while ( in_x == 0 && in_y == 0 );
-
-      /* extend the segment start whenever possible */
-      before = start;
-      do
-      {
-        do
-        {
-          start  = before;
-          before = before->prev;
-          if ( before == first )
-            goto Skip;
-
-          out_x = start->fx - before->fx;
-          out_y = start->fy - before->fy;
-
-        } while ( out_x == 0 && out_y == 0 );
-
-        orient_prev = ft_corner_orientation( in_x, in_y, out_x, out_y );
-
-      } while ( orient_prev == 0 );
-
-      first = start;
-
-      in_x = out_x;
-      in_y = out_y;
-
-      /* now process all segments in the contour */
-      do
-      {
-        /* first, extend current segment's end whenever possible */
-        after = end;
-        do
-        {
-          do
-          {
-            end   = after;
-            after = after->next;
-            if ( after == first )
-              finished = 1;
-
-            out_x = after->fx - end->fx;
-            out_y = after->fy - end->fy;
-
-          } while ( out_x == 0 && out_y == 0 );
-
-          orient_cur = ft_corner_orientation( in_x, in_y, out_x, out_y );
-
-        } while ( orient_cur == 0 );
-
-        if ( ( orient_prev + orient_cur ) == 0 )
-        {
-          /* we have an inflection point here */
-          do
-          {
-            start->flags |= AF_FLAG_INFLECTION;
-            start = start->next;
-
-          } while ( start != end );
-
-          start->flags |= AF_FLAG_INFLECTION;
-        }
-
-        start = end;
-        end   = after;
-
-        orient_prev = orient_cur;
-        in_x        = out_x;
-        in_y        = out_y;
-
-      } while ( !finished );
-
-    Skip:
-      ;
-    }
-  }
-
-
   FT_LOCAL_DEF( void )
   af_glyph_hints_init( AF_GlyphHints  hints,
                        FT_Memory      memory )
@@ -551,8 +437,7 @@
 
   FT_LOCAL_DEF( FT_Error )
   af_glyph_hints_reload( AF_GlyphHints  hints,
-                         FT_Outline*    outline,
+                         FT_Outline*    outline )
-                         FT_Bool        get_inflections )
   {
     FT_Error   error   = AF_Err_Ok;
     AF_Point   points;
@@ -639,13 +524,11 @@
       {
         FT_Vector*  vec           = outline->points;
         char*       tag           = outline->tags;
-        AF_Point    first         = points;
         AF_Point    end           = points + outline->contours[0];
         AF_Point    prev          = end;
         FT_Int      contour_index = 0;
 
 
-        FT_UNUSED( first );
         for ( point = points; point < point_limit; point++, vec++, tag++ )
         {
           point->fx = (FT_Short)vec->x;
@@ -673,9 +556,8 @@
           {
             if ( ++contour_index < outline->n_contours )
             {
-              first = point + 1;
+              end  = points + outline->contours[contour_index];
-              end   = points + outline->contours[contour_index];
+              prev = end;
-              prev  = end;
             }
           }
         }
@@ -752,11 +634,6 @@
       }
     }
 
-    /* compute inflection points --                 */
-    /* disabled due to no longer perceived benefits */
-    if ( 0 && get_inflections )
-      af_glyph_hints_compute_inflections( hints );
-
   Exit:
     return error;
   }

src/libs/freetype2/autofit/afhints.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter hinting routines (specification).                        */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008 by                        */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -286,8 +286,7 @@ FT_BEGIN_HEADER
 
   FT_LOCAL( FT_Error )
   af_glyph_hints_reload( AF_GlyphHints  hints,
-                         FT_Outline*    outline,
+                         FT_Outline*    outline );
-                         FT_Bool        get_inflections );
 
   FT_LOCAL( void )
   af_glyph_hints_save( AF_GlyphHints  hints,

src/libs/freetype2/autofit/aflatin.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter hinting routines for latin script (body).                */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009 by                  */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by            */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -77,7 +77,7 @@
 
       af_glyph_hints_rescale( hints, (AF_ScriptMetrics)dummy );
 
-      error = af_glyph_hints_reload( hints, &face->glyph->outline, 0 );
+      error = af_glyph_hints_reload( hints, &face->glyph->outline );
       if ( error )
         goto Exit;
 
@@ -2105,7 +2105,7 @@
     int       dim;
 
 
-    error = af_glyph_hints_reload( hints, outline, 1 );
+    error = af_glyph_hints_reload( hints, outline );
     if ( error )
       goto Exit;
 

src/libs/freetype2/autofit/aflatin2.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Auto-fitter hinting routines for latin script (body).                */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009 by                  */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by            */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -84,7 +84,7 @@
 
       af_glyph_hints_rescale( hints, (AF_ScriptMetrics)dummy );
 
-      error = af_glyph_hints_reload( hints, &face->glyph->outline, 0 );
+      error = af_glyph_hints_reload( hints, &face->glyph->outline );
       if ( error )
         goto Exit;
 
@@ -545,7 +545,8 @@
         FT_Pos  fitted = ( scaled + 40 ) & ~63;
 
 #if 1
-        if ( scaled != fitted ) {
+        if ( scaled != fitted )
+        {
           scale = FT_MulDiv( scale, fitted, scaled );
           AF_LOG(( "== scaled x-top = %.2g  fitted = %.2g, scaling = %.4g\n", scaled/64.0, fitted/64.0, (fitted*1.0)/scaled ));
         }
@@ -2249,7 +2250,7 @@
     int       dim;
 
 
-    error = af_glyph_hints_reload( hints, outline, 1 );
+    error = af_glyph_hints_reload( hints, outline );
     if ( error )
       goto Exit;
 

src/libs/freetype2/autofit/afpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for autofit module.  */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -45,19 +45,21 @@
     }
   }
 
+
   FT_Error
-  autofit_module_class_pic_init( FT_Library library )
+  autofit_module_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_UInt         ss;
+    FT_UInt            ss;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = AF_Err_Ok;
-    AFModulePIC*  container;
+    AFModulePIC*       container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->autofit = container;
 
     /* initialize pointer table - this is how the module usually expects this data */

src/libs/freetype2/base/ftgloadr.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType glyph loader (body).                                    */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006 by                              */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2010 by                        */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg                       */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -69,7 +69,7 @@
   FT_GlyphLoader_New( FT_Memory        memory,
                       FT_GlyphLoader  *aloader )
   {
-    FT_GlyphLoader  loader;
+    FT_GlyphLoader  loader = NULL;
     FT_Error        error;
 
 

src/libs/freetype2/base/ftglyph.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType convenience functions to handle glyphs (body).              */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2007, 2008 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2007, 2008, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -282,7 +282,7 @@
    {
      FT_Memory  memory = library->memory;
      FT_Error   error;
-     FT_Glyph   glyph;
+     FT_Glyph   glyph  = NULL;
 
 
      *aglyph = 0;

src/libs/freetype2/base/ftgxval.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType API for validating TrueTyepGX/AAT tables (body).            */
 /*                                                                         */
-/*  Copyright 2004, 2005, 2006 by                                          */
+/*  Copyright 2004, 2005, 2006, 2010 by                                    */
 /*  Masatake YAMATO, Redhat K.K,                                           */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
@@ -73,9 +73,14 @@
   FT_TrueTypeGX_Free( FT_Face   face,
                       FT_Bytes  table )
   {
-    FT_Memory  memory = FT_FACE_MEMORY( face );
+    FT_Memory  memory;
 
 
+    if ( !face )
+      return;
+
+    memory = FT_FACE_MEMORY( face );
+
     FT_FREE( table );
   }
 
@@ -119,7 +124,13 @@
   FT_ClassicKern_Free( FT_Face   face,
                        FT_Bytes  table )
   {
-    FT_Memory  memory = FT_FACE_MEMORY( face );
+    FT_Memory  memory;
+
+
+    if ( !face )
+      return;
+
+    memory = FT_FACE_MEMORY( face );
 
 
     FT_FREE( table );

src/libs/freetype2/base/ftinit.c

@@ -98,7 +98,8 @@
 #undef  FT_USE_MODULE
 #define FT_USE_MODULE( type, x )  MODULE_CLASS_##x,
 
-  enum {
+  enum
+  {
 #include FT_CONFIG_MODULES_H
     FT_NUM_MODULE_CLASSES
   };

src/libs/freetype2/base/ftlcdfil.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType API for color filtering of subpixel bitmap glyphs (body).   */
 /*                                                                         */
-/*  Copyright 2006, 2008, 2009 by                                          */
+/*  Copyright 2006, 2008, 2009, 2010 by                                    */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -267,18 +267,31 @@
 
 
   FT_EXPORT_DEF( FT_Error )
-  FT_Library_SetLcdFilter( FT_Library     library,
+  FT_Library_SetLcdFilterWeights( FT_Library      library,
-                           FT_LcdFilter   filter )
+                                  unsigned char  *weights )
+  {
+    if ( !library || !weights )
+      return FT_Err_Invalid_Argument;
+
+    ft_memcpy( library->lcd_weights, weights, 5 );
+
+    return FT_Err_Ok;
+  }
+
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Library_SetLcdFilter( FT_Library    library,
+                           FT_LcdFilter  filter )
   {
     static const FT_Byte  light_filter[5] =
-                            { 0, 85, 86, 85, 0 };
+                            { 0x00, 0x55, 0x56, 0x55, 0x00 };
     /* the values here sum up to a value larger than 256, */
     /* providing a cheap gamma correction                 */
     static const FT_Byte  default_filter[5] =
                             { 0x10, 0x40, 0x70, 0x40, 0x10 };
 
 
-    if ( library == NULL )
+    if ( !library )
       return FT_Err_Invalid_Argument;
 
     switch ( filter )
@@ -330,11 +343,23 @@
     }
 
     library->lcd_filter = filter;
-    return 0;
+
+    return FT_Err_Ok;
   }
 
 #else /* !FT_CONFIG_OPTION_SUBPIXEL_RENDERING */
 
+  FT_EXPORT_DEF( FT_Error )
+  FT_Library_SetLcdFilterWeights( FT_Library      library,
+                                  unsigned char  *weights )
+  {
+    FT_UNUSED( library );
+    FT_UNUSED( weights );
+
+    return FT_Err_Unimplemented_Feature;
+  }
+
+
   FT_EXPORT_DEF( FT_Error )
   FT_Library_SetLcdFilter( FT_Library    library,
                            FT_LcdFilter  filter )

src/libs/freetype2/base/ftobjs.c

@@ -29,7 +29,6 @@
 #include FT_TRUETYPE_TABLES_H
 #include FT_TRUETYPE_TAGS_H
 #include FT_TRUETYPE_IDS_H
-#include FT_OUTLINE_H
 
 #include FT_SERVICE_SFNT_H
 #include FT_SERVICE_POSTSCRIPT_NAME_H
@@ -143,7 +142,7 @@
     if ( !args )
       return FT_Err_Invalid_Argument;
 
-    memory   = library->memory;
+    memory = library->memory;
 
     if ( FT_NEW( stream ) )
       goto Exit;
@@ -230,11 +229,11 @@
   static FT_Error
   ft_glyphslot_init( FT_GlyphSlot  slot )
   {
-    FT_Driver         driver = slot->face->driver;
+    FT_Driver         driver   = slot->face->driver;
-    FT_Driver_Class   clazz  = driver->clazz;
+    FT_Driver_Class   clazz    = driver->clazz;
-    FT_Memory         memory = driver->root.memory;
+    FT_Memory         memory   = driver->root.memory;
-    FT_Error          error  = FT_Err_Ok;
+    FT_Error          error    = FT_Err_Ok;
-    FT_Slot_Internal  internal;
+    FT_Slot_Internal  internal = NULL;
 
 
     slot->library = driver->root.library;
@@ -992,6 +991,14 @@
              ( cur[0]->platform_id == TT_PLATFORM_APPLE_UNICODE &&
                cur[0]->encoding_id == TT_APPLE_ID_UNICODE_32    ) )
         {
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+          if ( cur - first > FT_MAX_CHARMAP_CACHEABLE )
+          {
+            FT_ERROR(( "find_unicode_charmap: UCS-4 cmap is found "
+                       "at too late position (%d)\n", cur - first ));
+            continue;
+          }
+#endif
           face->charmap = cur[0];
           return FT_Err_Ok;
         }
@@ -1006,6 +1013,14 @@
     {
       if ( cur[0]->encoding == FT_ENCODING_UNICODE )
       {
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( cur - first > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "find_unicode_charmap: UCS-2 cmap is found "
+                     "at too late position (%d)\n", cur - first ));
+          continue;
+        }
+#endif
         face->charmap = cur[0];
         return FT_Err_Ok;
       }
@@ -1047,6 +1062,14 @@
       if ( cur[0]->platform_id == TT_PLATFORM_APPLE_UNICODE    &&
            cur[0]->encoding_id == TT_APPLE_ID_VARIANT_SELECTOR &&
            FT_Get_CMap_Format( cur[0] ) == 14                  )
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( cur - first > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "find_unicode_charmap: UVS cmap is found "
+                     "at too late position (%d)\n", cur - first ));
+          continue;
+        }
+#endif
         return cur[0];
     }
 
@@ -1548,11 +1571,26 @@
         goto Exit;
       if ( FT_READ_USHORT( flags ) )
         goto Exit;
-      rlen -= 2;                    /* the flags are part of the resource */
+      FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",
+                   i, offsets[i], rlen, flags ));
+
+      /* postpone the check of rlen longer than buffer until FT_Stream_Read() */
+      if ( ( flags >> 8 ) == 0 )        /* Comment, should not be loaded */
+        continue;
+
+      /* the flags are part of the resource, so rlen >= 2.  */
+      /* but some fonts declare rlen = 0 for empty fragment */
+      if ( rlen > 2 )
+        rlen -= 2;
+      else
+        rlen = 0;
+
       if ( ( flags >> 8 ) == type )
         len += rlen;
       else
       {
+        if ( pfb_lenpos + 3 > pfb_len + 2 )
+          goto Exit2;
         pfb_data[pfb_lenpos    ] = (FT_Byte)( len );
         pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );
         pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );
@@ -1561,6 +1599,8 @@
         if ( ( flags >> 8 ) == 5 )      /* End of font mark */
           break;
 
+        if ( pfb_pos + 6 > pfb_len + 2 )
+          goto Exit2;
         pfb_data[pfb_pos++] = 0x80;
 
         type = flags >> 8;
@@ -1574,13 +1614,23 @@
         pfb_data[pfb_pos++] = 0;
       }
 
+      error = FT_Err_Cannot_Open_Resource;
+      if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )
+        goto Exit2;
+
       error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );
+      if ( error )
+        goto Exit2;
       pfb_pos += rlen;
     }
 
+    if ( pfb_pos + 2 > pfb_len + 2 )
+      goto Exit2;
     pfb_data[pfb_pos++] = 0x80;
     pfb_data[pfb_pos++] = 3;
 
+    if ( pfb_lenpos + 3 > pfb_len + 2 )
+      goto Exit2;
     pfb_data[pfb_lenpos    ] = (FT_Byte)( len );
     pfb_data[pfb_lenpos + 1] = (FT_Byte)( len >> 8 );
     pfb_data[pfb_lenpos + 2] = (FT_Byte)( len >> 16 );
@@ -1915,9 +1965,9 @@
     FT_Error     error;
     FT_Driver    driver;
     FT_Memory    memory;
-    FT_Stream    stream = 0;
+    FT_Stream    stream = NULL;
-    FT_Face      face = 0;
+    FT_Face      face   = NULL;
-    FT_ListNode  node = 0;
+    FT_ListNode  node   = NULL;
     FT_Bool      external_stream;
     FT_Module*   cur;
     FT_Module*   limit;
@@ -2141,6 +2191,8 @@
 
       internal->transform_delta.x = 0;
       internal->transform_delta.y = 0;
+
+      internal->refcount = 1;
     }
 
     if ( aface )
@@ -2226,6 +2278,17 @@
   }
 
 
+  /* documentation is in freetype.h */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Reference_Face( FT_Face  face )
+  {
+    face->internal->refcount++;
+
+    return FT_Err_Ok;
+  }
+
+
   /* documentation is in freetype.h */
 
   FT_EXPORT_DEF( FT_Error )
@@ -2240,22 +2303,29 @@
     error = FT_Err_Invalid_Face_Handle;
     if ( face && face->driver )
     {
-      driver = face->driver;
+      face->internal->refcount--;
-      memory = driver->root.memory;
+      if ( face->internal->refcount > 0 )
-
-      /* find face in driver's list */
-      node = FT_List_Find( &driver->faces_list, face );
-      if ( node )
-      {
-        /* remove face object from the driver's list */
-        FT_List_Remove( &driver->faces_list, node );
-        FT_FREE( node );
-
-        /* now destroy the object proper */
-        destroy_face( memory, face, driver );
         error = FT_Err_Ok;
+      else
+      {
+        driver = face->driver;
+        memory = driver->root.memory;
+
+        /* find face in driver's list */
+        node = FT_List_Find( &driver->faces_list, face );
+        if ( node )
+        {
+          /* remove face object from the driver's list */
+          FT_List_Remove( &driver->faces_list, node );
+          FT_FREE( node );
+
+          /* now destroy the object proper */
+          destroy_face( memory, face, driver );
+          error = FT_Err_Ok;
+        }
       }
     }
+
     return error;
   }
 
@@ -2901,6 +2971,15 @@
     {
       if ( cur[0]->encoding == encoding )
       {
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( cur - face->charmaps > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "FT_Select_Charmap: requested charmap is found (%d), "
+                     "but in too late position to cache\n",
+                     cur - face->charmaps ));
+          continue;
+        }
+#endif
         face->charmap = cur[0];
         return 0;
       }
@@ -2935,6 +3014,15 @@
     {
       if ( cur[0] == charmap )
       {
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( cur - face->charmaps > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "FT_Set_Charmap: requested charmap is found (%d), "
+                     "but in too late position to cache\n",
+                     cur - face->charmaps ));
+          continue;
+        }
+#endif
         face->charmap = cur[0];
         return 0;
       }
@@ -2951,12 +3039,24 @@
     FT_Int  i;
 
 
+    if ( !charmap || !charmap->face )
+      return -1;
+
     for ( i = 0; i < charmap->face->num_charmaps; i++ )
       if ( charmap->face->charmaps[i] == charmap )
         break;
 
     FT_ASSERT( i < charmap->face->num_charmaps );
 
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+    if ( i > FT_MAX_CHARMAP_CACHEABLE )
+    {
+      FT_ERROR(( "FT_Get_Charmap_Index: requested charmap is found (%d), "
+                 "but in too late position to cache\n",
+                 i ));
+      return -i;
+    }
+#endif
     return i;
   }
 
@@ -3095,7 +3195,7 @@
       }
       result = cmap->clazz->char_index( cmap, (FT_UInt32)charcode );
     }
-    return  result;
+    return result;
   }
 
 
@@ -3109,14 +3209,14 @@
     FT_UInt   gindex = 0;
 
 
-    if ( face && face->charmap )
+    if ( face && face->charmap && face->num_glyphs )
     {
       gindex = FT_Get_Char_Index( face, 0 );
-      if ( gindex == 0 )
+      if ( gindex == 0 || gindex >= (FT_UInt)face->num_glyphs )
         result = FT_Get_Next_Char( face, 0, &gindex );
     }
 
-    if ( agindex  )
+    if ( agindex )
       *agindex = gindex;
 
     return result;
@@ -3134,13 +3234,16 @@
     FT_UInt   gindex = 0;
 
 
-    if ( face && face->charmap )
+    if ( face && face->charmap && face->num_glyphs )
     {
       FT_UInt32  code = (FT_UInt32)charcode;
       FT_CMap    cmap = FT_CMAP( face->charmap );
 
 
-      gindex = cmap->clazz->char_next( cmap, &code );
+      do {
+        gindex = cmap->clazz->char_next( cmap, &code );
+      } while ( gindex >= (FT_UInt)face->num_glyphs );
+
       result = ( gindex == 0 ) ? 0 : code;
     }
 
@@ -3645,7 +3748,7 @@
     FT_Library   library = module->library;
     FT_Memory    memory  = library->memory;
     FT_Error     error;
-    FT_ListNode  node;
+    FT_ListNode  node    = NULL;
 
 
     if ( FT_NEW( node ) )
@@ -3661,7 +3764,7 @@
 
       /* allocate raster object if needed */
       if ( clazz->glyph_format == FT_GLYPH_FORMAT_OUTLINE &&
-           clazz->raster_class->raster_new )
+           clazz->raster_class->raster_new                )
       {
         error = clazz->raster_class->raster_new( memory, &render->raster );
         if ( error )
@@ -3702,7 +3805,8 @@
 
 
       /* release raster object, if any */
-      if ( render->raster )
+      if ( render->clazz->glyph_format == FT_GLYPH_FORMAT_OUTLINE &&
+           render->raster                                         )
         render->clazz->raster_class->raster_done( render->raster );
 
       /* remove from list */
@@ -3842,7 +3946,7 @@
     FT_Library  library;
 
 
-    if ( !slot )
+    if ( !slot || !slot->face )
       return FT_Err_Invalid_Argument;
 
     library = FT_FACE_LIBRARY( slot->face );
@@ -4029,7 +4133,8 @@
       FT_Renderer  renderer = FT_RENDERER( module );
 
 
-      if ( renderer->raster )
+      if ( renderer->clazz->glyph_format == FT_GLYPH_FORMAT_OUTLINE && 
+           renderer->raster                                         )
         renderer->clazz->raster_class->raster_done( renderer->raster );
     }
 
@@ -4182,13 +4287,24 @@
   /*************************************************************************/
 
 
+  /* documentation is in ftmodapi.h */
+
+  FT_EXPORT_DEF( FT_Error )
+  FT_Reference_Library( FT_Library  library )
+  {
+    library->refcount++;
+
+    return FT_Err_Ok;
+  }
+
+
   /* documentation is in ftmodapi.h */
 
   FT_EXPORT_DEF( FT_Error )
   FT_New_Library( FT_Memory    memory,
                   FT_Library  *alibrary )
   {
-    FT_Library  library = 0;
+    FT_Library  library = NULL;
     FT_Error    error;
 
 
@@ -4224,6 +4340,8 @@
     library->version_minor = FREETYPE_MINOR;
     library->version_patch = FREETYPE_PATCH;
 
+    library->refcount = 1;
+
     /* That's ok now */
     *alibrary = library;
 
@@ -4280,40 +4398,64 @@
     if ( !library )
       return FT_Err_Invalid_Library_Handle;
 
+    library->refcount--;
+    if ( library->refcount > 0 )
+      goto Exit;
+
     memory = library->memory;
 
     /* Discard client-data */
     if ( library->generic.finalizer )
       library->generic.finalizer( library );
 
-    /* Close all faces in the library.  If we don't do
+    /*
-     * this, we can have some subtle memory leaks.
+     * Close all faces in the library.  If we don't do this, we can have
+     * some subtle memory leaks.
+     *
      * Example:
      *
      *  - the cff font driver uses the pshinter module in cff_size_done
      *  - if the pshinter module is destroyed before the cff font driver,
      *    opened FT_Face objects managed by the driver are not properly
      *    destroyed, resulting in a memory leak
+     *
+     * Some faces are dependent on other faces, like Type42 faces that
+     * depend on TrueType faces synthesized internally.
+     *
+     * The order of drivers should be specified in driver_name[].
      */
     {
-      FT_UInt  n;
+      FT_UInt      m, n;
+      const char*  driver_name[] = { "type42", NULL };
 
 
-      for ( n = 0; n < library->num_modules; n++ )
+      for ( m = 0;
+            m < sizeof ( driver_name ) / sizeof ( driver_name[0] );
+            m++ )
       {
-        FT_Module  module = library->modules[n];
+        for ( n = 0; n < library->num_modules; n++ )
-        FT_List    faces;
-
-
-        if ( ( module->clazz->module_flags & FT_MODULE_FONT_DRIVER ) == 0 )
-          continue;
-
-        faces = &FT_DRIVER(module)->faces_list;
-        while ( faces->head )
         {
-          FT_Done_Face( FT_FACE( faces->head->data ) );
+          FT_Module    module      = library->modules[n];
-          if ( faces->head )
+          const char*  module_name = module->clazz->module_name;
-            FT_TRACE0(( "FT_Done_Library: failed to free some faces\n" ));
+          FT_List      faces;
+
+
+          if ( driver_name[m]                                &&
+               ft_strcmp( module_name, driver_name[m] ) != 0 )
+            continue;
+
+          if ( ( module->clazz->module_flags & FT_MODULE_FONT_DRIVER ) == 0 )
+            continue;
+
+          FT_TRACE7(( "FT_Done_Library: close faces for %s\n", module_name ));
+
+          faces = &FT_DRIVER( module )->faces_list;
+          while ( faces->head )
+          {
+            FT_Done_Face( FT_FACE( faces->head->data ) );
+            if ( faces->head )
+              FT_TRACE0(( "FT_Done_Library: failed to free some faces\n" ));
+          }
         }
       }
     }
@@ -4355,6 +4497,8 @@
 #endif
 
     FT_FREE( library );
+
+  Exit:
     return FT_Err_Ok;
   }
 
@@ -4467,6 +4611,8 @@
 #endif /* FT_CONFIG_OPTION_OLD_INTERNALS */
 
 
+  /* documentation is in freetype.h */
+
   FT_EXPORT_DEF( FT_Error )
   FT_Get_SubGlyph_Info( FT_GlyphSlot  glyph,
                         FT_UInt       sub_index,
@@ -4479,7 +4625,8 @@
     FT_Error  error = FT_Err_Invalid_Argument;
 
 
-    if ( glyph != NULL                              &&
+    if ( glyph                                      &&
+         glyph->subglyphs                           &&
          glyph->format == FT_GLYPH_FORMAT_COMPOSITE &&
          sub_index < glyph->num_subglyphs           )
     {

src/libs/freetype2/base/ftotval.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType API for validating OpenType tables (body).                  */
 /*                                                                         */
-/*  Copyright 2004, 2006, 2008 by                                          */
+/*  Copyright 2004, 2006, 2008, 2010 by                                    */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -74,9 +74,14 @@
   FT_OpenType_Free( FT_Face   face,
                     FT_Bytes  table )
   {
-    FT_Memory  memory = FT_FACE_MEMORY( face );
+    FT_Memory  memory;
 
 
+    if ( !face )
+      return;
+
+    memory = FT_FACE_MEMORY( face );
+
     FT_FREE( table );
   }
 

src/libs/freetype2/base/ftoutln.c

@@ -990,7 +990,8 @@
 
     int             i;
     FT_Pos          ray_y[3];
-    FT_Orientation  result[3];
+    FT_Orientation  result[3] =
+      { FT_ORIENTATION_NONE, FT_ORIENTATION_NONE, FT_ORIENTATION_NONE };
 
 
     if ( !outline || outline->n_points <= 0 )

src/libs/freetype2/base/ftpfr.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType API for accessing PFR-specific data (body).                 */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2008 by                                    */
+/*  Copyright 2002, 2003, 2004, 2008, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -24,10 +24,11 @@
   static FT_Service_PfrMetrics
   ft_pfr_check( FT_Face  face )
   {
-    FT_Service_PfrMetrics  service;
+    FT_Service_PfrMetrics  service = NULL;
 
 
-    FT_FACE_LOOKUP_SERVICE( face, service, PFR_METRICS );
+    if ( face )
+      FT_FACE_LOOKUP_SERVICE( face, service, PFR_METRICS );
 
     return service;
   }

src/libs/freetype2/base/ftrfork.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Embedded resource forks accessor (body).                             */
 /*                                                                         */
-/*  Copyright 2004, 2005, 2006, 2007, 2008, 2009 by                        */
+/*  Copyright 2004, 2005, 2006, 2007, 2008, 2009, 2010 by                  */
 /*  Masatake YAMATO and Redhat K.K.                                        */
 /*                                                                         */
 /*  FT_Raccess_Get_HeaderInfo() and raccess_guess_darwin_hfsplus() are     */
@@ -751,7 +751,7 @@
                           const char  *original_name,
                           const char  *insertion )
   {
-    char*        new_name;
+    char*        new_name = NULL;
     const char*  tmp;
     const char*  slash;
     size_t       new_length;

src/libs/freetype2/base/ftstream.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    I/O stream support (body).                                           */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2004, 2005, 2006, 2008, 2009 by             */
+/*  Copyright 2000-2001, 2002, 2004, 2005, 2006, 2008, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -246,6 +246,18 @@
       /* allocate the frame in memory */
       FT_Memory  memory = stream->memory;
 
+
+      /* simple sanity check */
+      if ( count > stream->size )
+      {
+        FT_ERROR(( "FT_Stream_EnterFrame:"
+                   " frame size (%lu) larger than stream size (%lu)\n",
+                   count, stream->size ));
+
+        error = FT_Err_Invalid_Stream_Operation;
+        goto Exit;
+      }
+
 #ifdef FT_DEBUG_MEMORY
       /* assume _ft_debug_file and _ft_debug_lineno are already set */
       stream->base = (unsigned char*)ft_mem_qalloc( memory, count, &error );
@@ -275,7 +287,7 @@
     {
       /* check current and new position */
       if ( stream->pos >= stream->size        ||
-           stream->pos + count > stream->size )
+           stream->size - stream->pos < count )
       {
         FT_ERROR(( "FT_Stream_EnterFrame:"
                    " invalid i/o; pos = 0x%lx, count = %lu, size = 0x%lx\n",

src/libs/freetype2/base/ftsystem.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    ANSI-specific FreeType low-level system interface (body).            */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2006, 2008, 2009 by                         */
+/*  Copyright 1996-2001, 2002, 2006, 2008, 2009, 2010 by                   */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -192,7 +192,9 @@
   /*    count  :: The number of bytes to read from the stream.             */
   /*                                                                       */
   /* <Return>                                                              */
-  /*    The number of bytes actually read.                                 */
+  /*    The number of bytes actually read.  If `count' is zero (this is,   */
+  /*    the function is used for seeking), a non-zero return value         */
+  /*    indicates an error.                                                */
   /*                                                                       */
   FT_CALLBACK_DEF( unsigned long )
   ft_ansi_stream_io( FT_Stream       stream,
@@ -203,6 +205,9 @@
     FT_FILE*  file;
 
 
+    if ( !count && offset > stream->size )
+      return 1;
+
     file = STREAM_FILE( stream );
 
     if ( stream->pos != offset )

src/libs/freetype2/bdf/bdfdrivr.c

@@ -30,6 +30,7 @@ THE SOFTWARE.
 #include FT_INTERNAL_STREAM_H
 #include FT_INTERNAL_OBJECTS_H
 #include FT_BDF_H
+#include FT_TRUETYPE_IDS_H 
 
 #include FT_SERVICE_BDF_H
 #include FT_SERVICE_XFREE86_NAME_H
@@ -540,14 +541,15 @@ THE SOFTWARE.
 
               charmap.face        = FT_FACE( face );
               charmap.encoding    = FT_ENCODING_NONE;
-              charmap.platform_id = 0;
+              /* initial platform/encoding should indicate unset status? */
-              charmap.encoding_id = 0;
+              charmap.platform_id = TT_PLATFORM_APPLE_UNICODE;
+              charmap.encoding_id = TT_APPLE_ID_DEFAULT;
 
               if ( unicode_charmap )
               {
                 charmap.encoding    = FT_ENCODING_UNICODE;
-                charmap.platform_id = 3;
+                charmap.platform_id = TT_PLATFORM_MICROSOFT;
-                charmap.encoding_id = 1;
+                charmap.encoding_id = TT_MS_ID_UNICODE_CS;
               }
 
               error = FT_CMap_New( &bdf_cmap_class, NULL, &charmap, NULL );
@@ -571,8 +573,8 @@ THE SOFTWARE.
 
           charmap.face        = FT_FACE( face );
           charmap.encoding    = FT_ENCODING_ADOBE_STANDARD;
-          charmap.platform_id = 7;
+          charmap.platform_id = TT_PLATFORM_ADOBE;
-          charmap.encoding_id = 0;
+          charmap.encoding_id = TT_ADOBE_ID_STANDARD;
 
           error = FT_CMap_New( &bdf_cmap_class, NULL, &charmap, NULL );
 

src/libs/freetype2/bdf/bdflib.c

@@ -1,6 +1,6 @@
 /*
  * Copyright 2000 Computing Research Labs, New Mexico State University
- * Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009
+ * Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010
  *   Francesco Zappa Nardelli
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -470,6 +470,11 @@
   }
 
 
+  /* An empty string for empty fields. */
+
+  static const char  empty[1] = { 0 };      /* XXX eliminate this */
+
+
   static char *
   _bdf_list_join( _bdf_list_t*    list,
                   int             c,
@@ -494,18 +499,14 @@
       if ( i + 1 < list->used )
         dp[j++] = (char)c;
     }
-    dp[j] = 0;
+    if ( dp != empty )
+      dp[j] = 0;
 
     *alen = j;
     return dp;
   }
 
 
-  /* An empty string for empty fields. */
-
-  static const char  empty[1] = { 0 };      /* XXX eliminate this */
-
-
   static FT_Error
   _bdf_list_split( _bdf_list_t*   list,
                    char*          separators,
@@ -648,8 +649,9 @@
     {
       if ( refill )
       {
-        bytes  = (ptrdiff_t)FT_Stream_TryRead( stream, (FT_Byte*)buf + cursor,
+        bytes  = (ptrdiff_t)FT_Stream_TryRead(
-                                               (FT_ULong)(buf_size - cursor) );
+                   stream, (FT_Byte*)buf + cursor,
+                   (FT_ULong)( buf_size - cursor ) );
         avail  = cursor + bytes;
         cursor = 0;
         refill = 0;
@@ -719,6 +721,10 @@
       {
         error = (*cb)( buf + start, end - start, lineno,
                        (void*)&cb, client_data );
+        /* Redo if we have encountered CHARS without properties. */
+        if ( error == -1 )
+          error = (*cb)( buf + start, end - start, lineno,
+                         (void*)&cb, client_data );
         if ( error )
           break;
       }
@@ -1371,7 +1377,8 @@
 
     /* If the property happens to be a comment, then it doesn't need */
     /* to be added to the internal hash table.                       */
-    if ( ft_memcmp( name, "COMMENT", 7 ) != 0 ) {
+    if ( ft_memcmp( name, "COMMENT", 7 ) != 0 )
+    {
       /* Add the property to the font property table. */
       error = hash_insert( fp->name,
                            font->props_used,
@@ -1867,6 +1874,9 @@
     error = BDF_Err_Invalid_File_Format;
 
   Exit:
+    if ( error && ( p->flags & _BDF_GLYPH ) )
+      FT_FREE( p->glyph_name );
+
     return error;
   }
 
@@ -2077,6 +2087,14 @@
     /* Check for the start of the properties. */
     if ( ft_memcmp( line, "STARTPROPERTIES", 15 ) == 0 )
     {
+      if ( !( p->flags & _BDF_FONT_BBX ) )
+      {
+        /* Missing the FONTBOUNDINGBOX field. */
+        FT_ERROR(( "_bdf_parse_start: " ERRMSG1, lineno, "FONTBOUNDINGBOX" ));
+        error = BDF_Err_Missing_Fontboundingbox_Field;
+        goto Exit;
+      }
+
       error = _bdf_list_split( &p->list, (char *)" +", line, linelen );
       if ( error )
         goto Exit;
@@ -2095,7 +2113,7 @@
     /* Check for the FONTBOUNDINGBOX field. */
     if ( ft_memcmp( line, "FONTBOUNDINGBOX", 15 ) == 0 )
     {
-      if ( !(p->flags & _BDF_SIZE ) )
+      if ( !( p->flags & _BDF_SIZE ) )
       {
         /* Missing the SIZE field. */
         FT_ERROR(( "_bdf_parse_start: " ERRMSG1, lineno, "SIZE" ));
@@ -2139,6 +2157,9 @@
         goto Exit;
       }
 
+      /* Allowing multiple `FONT' lines (which is invalid) doesn't hurt... */
+      FT_FREE( p->font->name );
+
       if ( FT_NEW_ARRAY( p->font->name, slen + 1 ) )
         goto Exit;
       FT_MEM_COPY( p->font->name, s, slen + 1 );
@@ -2208,6 +2229,45 @@
       goto Exit;
     }
 
+    /* Check for the CHARS field -- font properties are optional */
+    if ( ft_memcmp( line, "CHARS", 5 ) == 0 )
+    {
+      char  nbuf[128];
+
+
+      if ( !( p->flags & _BDF_FONT_BBX ) )
+      {
+        /* Missing the FONTBOUNDINGBOX field. */
+        FT_ERROR(( "_bdf_parse_start: " ERRMSG1, lineno, "FONTBOUNDINGBOX" ));
+        error = BDF_Err_Missing_Fontboundingbox_Field;
+        goto Exit;
+      }
+
+      /* Add the two standard X11 properties which are required */
+      /* for compiling fonts.                                   */
+      p->font->font_ascent = p->font->bbx.ascent;
+      ft_sprintf( nbuf, "%hd", p->font->bbx.ascent );
+      error = _bdf_add_property( p->font, (char *)"FONT_ASCENT", nbuf );
+      if ( error )
+        goto Exit;
+      FT_TRACE2(( "_bdf_parse_properties: " ACMSG1, p->font->bbx.ascent ));
+
+      p->font->font_descent = p->font->bbx.descent;
+      ft_sprintf( nbuf, "%hd", p->font->bbx.descent );
+      error = _bdf_add_property( p->font, (char *)"FONT_DESCENT", nbuf );
+      if ( error )
+        goto Exit;
+      FT_TRACE2(( "_bdf_parse_properties: " ACMSG2, p->font->bbx.descent ));
+
+      p->font->modified = 1;
+
+      *next = _bdf_parse_glyphs;
+
+      /* A special return value. */
+      error = -1;
+      goto Exit;
+    }
+
     error = BDF_Err_Invalid_File_Format;
 
   Exit:
@@ -2229,7 +2289,7 @@
                  bdf_font_t*    *font )
   {
     unsigned long  lineno = 0; /* make compiler happy */
-    _bdf_parse_t   *p;
+    _bdf_parse_t   *p     = NULL;
 
     FT_Memory      memory = extmemory;
     FT_Error       error  = BDF_Err_Ok;
@@ -2344,7 +2404,8 @@
       /* Make sure the comments are NULL terminated if they exist. */
       memory = p->font->memory;
 
-      if ( p->font->comments_len > 0 ) {
+      if ( p->font->comments_len > 0 )
+      {
         if ( FT_RENEW_ARRAY( p->font->comments,
                              p->font->comments_len,
                              p->font->comments_len + 1 ) )
@@ -2448,8 +2509,8 @@
     hash_free( &(font->proptbl), memory );
 
     /* Free up the user defined properties. */
-    for (prop = font->user_props, i = 0;
+    for ( prop = font->user_props, i = 0;
-         i < font->nuser_props; i++, prop++ )
+          i < font->nuser_props; i++, prop++ )
     {
       FT_FREE( prop->name );
       if ( prop->format == BDF_ATOM )

src/libs/freetype2/cache/ftcbasic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType basic cache interface (body).                           */
 /*                                                                         */
-/*  Copyright 2003, 2004, 2005, 2006, 2007, 2009 by                        */
+/*  Copyright 2003, 2004, 2005, 2006, 2007, 2009, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -834,7 +834,7 @@
 
 
     if ( !desc )
-      return FT_Err_Invalid_Argument;
+      return FTC_Err_Invalid_Argument;
 
     ftc_image_type_from_old_desc( &type0, desc );
 

src/libs/freetype2/cache/ftccache.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType internal cache interface (body).                        */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -485,13 +485,13 @@
     FTC_Node*  bucket;
     FTC_Node*  pnode;
     FTC_Node   node;
-    FT_Error   error = 0;
+    FT_Error   error = FTC_Err_Ok;
 
     FTC_Node_CompareFunc  compare = cache->clazz.node_compare;
 
 
     if ( cache == NULL || anode == NULL )
-      return FT_Err_Invalid_Argument;
+      return FTC_Err_Invalid_Argument;
 
     idx = hash & cache->mask;
     if ( idx < cache->p )

src/libs/freetype2/cache/ftccache.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType internal cache interface (specification).                   */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -205,7 +205,7 @@ FT_BEGIN_HEADER
     FT_UFast              _idx;                                          \
                                                                          \
                                                                          \
-    error = 0;                                                           \
+    error = FTC_Err_Ok;                                                  \
     node  = NULL;                                                        \
     _idx  = _hash & _cache->mask;                                        \
     if ( _idx < _cache->p )                                              \
@@ -288,7 +288,7 @@ FT_BEGIN_HEADER
 
 
 #define FTC_CACHE_TRYLOOP_END()                                   \
-      if ( !error || error != FT_Err_Out_Of_Memory )              \
+      if ( !error || error != FTC_Err_Out_Of_Memory )             \
         break;                                                    \
                                                                   \
       _try_done = FTC_Manager_FlushN( _try_manager, _try_count ); \

src/libs/freetype2/cache/ftccmap.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    FreeType CharMap cache (body)                                        */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -153,7 +154,7 @@
     FTC_CMapQuery  query  = (FTC_CMapQuery)ftcquery;
     FT_Error       error;
     FT_Memory      memory = cache->memory;
-    FTC_CMapNode   node;
+    FTC_CMapNode   node   = NULL;
     FT_UInt        nn;
 
 
@@ -310,19 +311,11 @@
 #ifdef FT_CONFIG_OPTION_OLD_INTERNALS
 
     /*
-     *  Detect a call from a rogue client that thinks it is linking
+     * If cmap_index is greater than the maximum number of cachable
-     *  to FreeType 2.1.7.  This is possible because the third parameter
+     * charmaps, we assume the request is from a legacy rogue client 
-     *  is then a character code, and we have never seen any font with
+     * using old internal header. See include/config/ftoption.h.
-     *  more than a few charmaps, so if the index is very large...
-     *
-     *  It is also very unlikely that a rogue client is interested
-     *  in Unicode values 0 to 15.
-     *
-     *  NOTE: The original threshold was 4, but we found a font from the
-     *        Adobe Acrobat Reader Pack, named `KozMinProVI-Regular.otf',
-     *        which contains more than 5 charmaps.
      */
-    if ( cmap_index >= 16 && !no_cmap_change )
+    if ( cmap_index > FT_MAX_CHARMAP_CACHEABLE && !no_cmap_change )
     {
       FTC_OldCMapDesc  desc = (FTC_OldCMapDesc) face_id;
 
@@ -384,7 +377,7 @@
     /* something rotten can happen with rogue clients */
     if ( (FT_UInt)( char_code - FTC_CMAP_NODE( node )->first >=
                     FTC_CMAP_INDICES_MAX ) )
-      return 0;
+      return 0; /* XXX: should return appropriate error */
 
     gindex = FTC_CMAP_NODE( node )->indices[char_code -
                                             FTC_CMAP_NODE( node )->first];
@@ -401,6 +394,12 @@
       if ( error )
         goto Exit;
 
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+      /* something rotten can happen with rogue clients */
+      if ( cmap_index > FT_MAX_CHARMAP_CACHEABLE )
+        return 0; /* XXX: should return appropriate error */
+#endif
+
       if ( (FT_UInt)cmap_index < (FT_UInt)face->num_charmaps )
       {
         FT_CharMap  old, cmap  = NULL;

src/libs/freetype2/cache/ftcimage.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType Image cache (body).                                         */
 /*                                                                         */
-/*  Copyright 2000-2001, 2003, 2004, 2006 by                               */
+/*  Copyright 2000-2001, 2003, 2004, 2006, 2010 by                         */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -61,7 +61,7 @@
   {
     FT_Memory  memory = cache->memory;
     FT_Error   error;
-    FTC_INode  inode;
+    FTC_INode  inode  = NULL;
 
 
     if ( !FT_NEW( inode ) )

src/libs/freetype2/cache/ftcmanag.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType Cache Manager (body).                                       */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2009 by       */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -670,7 +670,7 @@
      * the face_id as well
      */
     FTC_MruList_RemoveSelection( &manager->faces,
-                                 (FTC_MruNode_CompareFunc)NULL,
+                                 ftc_face_node_compare,
                                  face_id );
 
     for ( nn = 0; nn < manager->num_caches; nn++ )

src/libs/freetype2/cache/ftcmru.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Simple MRU list-cache (specification).                               */
 /*                                                                         */
-/*  Copyright 2000-2001, 2003, 2004, 2005, 2006 by                         */
+/*  Copyright 2000-2001, 2003, 2004, 2005, 2006, 2010 by                   */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -166,7 +166,7 @@ FT_BEGIN_HEADER
     FTC_MruNode              _first, _node;                                 \
                                                                             \
                                                                             \
-    error  = 0;                                                             \
+    error  = FTC_Err_Ok;                                                    \
     _first = *(_pfirst);                                                    \
     _node  = NULL;                                                          \
                                                                             \

src/libs/freetype2/cache/ftcsbits.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType sbits manager (body).                                       */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2009 by             */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -191,7 +191,7 @@
       sbit->width  = 255;
       sbit->height = 0;
       sbit->buffer = NULL;
-      error        = 0;
+      error        = FTC_Err_Ok;
       if ( asize )
         *asize = 0;
     }
@@ -218,7 +218,7 @@
     total = clazz->family_get_count( family, cache->manager );
     if ( total == 0 || gindex >= total )
     {
-      error = FT_Err_Invalid_Argument;
+      error = FTC_Err_Invalid_Argument;
       goto Exit;
     }
 

src/libs/freetype2/cff/cffcmap.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    CFF character mapping table (cmap) support (body).                   */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007 by                        */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -120,27 +120,15 @@
   /*************************************************************************/
 
   FT_CALLBACK_DEF( const char* )
-  cff_sid_to_glyph_name( TT_Face   face,
+  cff_sid_to_glyph_name( TT_Face  face,
-                         FT_UInt   idx )
+                         FT_UInt  idx )
   {
-    CFF_Font            cff     = (CFF_Font)face->extra.data;
+    CFF_Font     cff     = (CFF_Font)face->extra.data;
-    CFF_Charset         charset = &cff->charset;
+    CFF_Charset  charset = &cff->charset;
-    FT_Service_PsCMaps  psnames = (FT_Service_PsCMaps)cff->psnames;
+    FT_UInt      sid     = charset->sids[idx];
-    FT_UInt             sid     = charset->sids[idx];
 
 
-    return cff_index_get_sid_string( &cff->string_index, sid, psnames );
+    return cff_index_get_sid_string( cff, sid );
-  }
-
-
-  FT_CALLBACK_DEF( void )
-  cff_sid_free_glyph_name( TT_Face      face,
-                           const char*  gname )
-  {
-    FT_Memory  memory = FT_FACE_MEMORY( face );
-
-
-    FT_FREE( gname );
   }
 
 
@@ -155,14 +143,15 @@
 
 
     /* can't build Unicode map for CID-keyed font */
+    /* because we don't know glyph names.         */
     if ( !charset->sids )
-      return CFF_Err_Invalid_Argument;
+      return CFF_Err_No_Unicode_Glyph_Name;
 
     return psnames->unicodes_init( memory,
                                    unicodes,
                                    cff->num_glyphs,
                                    (PS_GetGlyphNameFunc)&cff_sid_to_glyph_name,
-                                   (PS_FreeGlyphNameFunc)&cff_sid_free_glyph_name,
+                                   (PS_FreeGlyphNameFunc)NULL,
                                    (FT_Pointer)face );
   }
 

src/libs/freetype2/cff/cffdrivr.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    OpenType font driver implementation (body).                          */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -22,7 +23,6 @@
 #include FT_INTERNAL_STREAM_H
 #include FT_INTERNAL_SFNT_H
 #include FT_SERVICE_CID_H
-#include FT_SERVICE_POSTSCRIPT_CMAPS_H
 #include FT_SERVICE_POSTSCRIPT_INFO_H
 #include FT_SERVICE_POSTSCRIPT_NAME_H
 #include FT_SERVICE_TT_CMAP_H
@@ -228,16 +228,13 @@
                       FT_Pointer  buffer,
                       FT_UInt     buffer_max )
   {
-    CFF_Font            font   = (CFF_Font)face->extra.data;
+    CFF_Font    font   = (CFF_Font)face->extra.data;
-    FT_Memory           memory = FT_FACE_MEMORY( face );
+    FT_String*  gname;
-    FT_String*          gname;
+    FT_UShort   sid;
-    FT_UShort           sid;
+    FT_Error    error;
-    FT_Service_PsCMaps  psnames;
-    FT_Error            error;
 
 
-    FT_FACE_FIND_GLOBAL_SERVICE( face, psnames, POSTSCRIPT_CMAPS );
+    if ( !font->psnames )
-    if ( !psnames )
     {
       FT_ERROR(( "cff_get_glyph_name:"
                  " cannot get glyph name from CFF & CEF fonts\n"
@@ -251,12 +248,11 @@
     sid = font->charset.sids[glyph_index];
 
     /* now, lookup the name itself */
-    gname = cff_index_get_sid_string( &font->string_index, sid, psnames );
+    gname = cff_index_get_sid_string( font, sid );
 
     if ( gname )
       FT_STRCPYN( buffer, gname, buffer_max );
 
-    FT_FREE( gname );
     error = CFF_Err_Ok;
 
   Exit:
@@ -271,11 +267,9 @@
     CFF_Font            cff;
     CFF_Charset         charset;
     FT_Service_PsCMaps  psnames;
-    FT_Memory           memory = FT_FACE_MEMORY( face );
     FT_String*          name;
     FT_UShort           sid;
     FT_UInt             i;
-    FT_Int              result;
 
 
     cff     = (CFF_FontRec *)face->extra.data;
@@ -290,19 +284,14 @@
       sid = charset->sids[i];
 
       if ( sid > 390 )
-        name = cff_index_get_name( &cff->string_index, sid - 391 );
+        name = cff_index_get_string( cff, sid - 391 );
       else
         name = (FT_String *)psnames->adobe_std_strings( sid );
 
       if ( !name )
         continue;
 
-      result = ft_strcmp( glyph_name, name );
+      if ( !ft_strcmp( glyph_name, name ) )
-
-      if ( sid > 390 )
-        FT_FREE( name );
-
-      if ( !result )
         return i;
     }
 
@@ -333,35 +322,29 @@
                         PS_FontInfoRec*  afont_info )
   {
     CFF_Font  cff   = (CFF_Font)face->extra.data;
-    FT_Error  error = FT_Err_Ok;
+    FT_Error  error = CFF_Err_Ok;
 
 
     if ( cff && cff->font_info == NULL )
     {
-      CFF_FontRecDict     dict    = &cff->top_font.font_dict;
+      CFF_FontRecDict  dict   = &cff->top_font.font_dict;
-      PS_FontInfoRec     *font_info;
+      PS_FontInfoRec  *font_info;
-      FT_Memory           memory  = face->root.memory;
+      FT_Memory        memory = face->root.memory;
-      FT_Service_PsCMaps  psnames = (FT_Service_PsCMaps)cff->psnames;
 
 
       if ( FT_ALLOC( font_info, sizeof ( *font_info ) ) )
         goto Fail;
 
-      font_info->version     = cff_index_get_sid_string( &cff->string_index,
+      font_info->version     = cff_index_get_sid_string( cff,
-                                                         dict->version,
+                                                         dict->version );
-                                                         psnames );
+      font_info->notice      = cff_index_get_sid_string( cff,
-      font_info->notice      = cff_index_get_sid_string( &cff->string_index,
+                                                         dict->notice );
-                                                         dict->notice,
+      font_info->full_name   = cff_index_get_sid_string( cff,
-                                                         psnames );
+                                                         dict->full_name );
-      font_info->full_name   = cff_index_get_sid_string( &cff->string_index,
+      font_info->family_name = cff_index_get_sid_string( cff,
-                                                         dict->full_name,
+                                                         dict->family_name );
-                                                         psnames );
+      font_info->weight      = cff_index_get_sid_string( cff,
-      font_info->family_name = cff_index_get_sid_string( &cff->string_index,
+                                                         dict->weight );
-                                                         dict->family_name,
-                                                         psnames );
-      font_info->weight      = cff_index_get_sid_string( &cff->string_index,
-                                                         dict->weight,
-                                                         psnames );
       font_info->italic_angle        = dict->italic_angle;
       font_info->is_fixed_pitch      = dict->is_fixed_pitch;
       font_info->underline_position  = (FT_Short)dict->underline_position;
@@ -467,8 +450,7 @@
 
     if ( cff )
     {
-      CFF_FontRecDict     dict    = &cff->top_font.font_dict;
+      CFF_FontRecDict  dict = &cff->top_font.font_dict;
-      FT_Service_PsCMaps  psnames = (FT_Service_PsCMaps)cff->psnames;
 
 
       if ( dict->cid_registry == 0xFFFFU )
@@ -480,18 +462,16 @@
       if ( registry )
       {
         if ( cff->registry == NULL )
-          cff->registry = cff_index_get_sid_string( &cff->string_index,
+          cff->registry = cff_index_get_sid_string( cff,
-                                                    dict->cid_registry,
+                                                    dict->cid_registry );
-                                                    psnames );
         *registry = cff->registry;
       }
       
       if ( ordering )
       {
         if ( cff->ordering == NULL )
-          cff->ordering = cff_index_get_sid_string( &cff->string_index,
+          cff->ordering = cff_index_get_sid_string( cff,
-                                                    dict->cid_ordering,
+                                                    dict->cid_ordering );
-                                                    psnames );
         *ordering = cff->ordering;
       }
 

src/libs/freetype2/cff/cffgload.c

@@ -22,7 +22,6 @@
 #include FT_INTERNAL_STREAM_H
 #include FT_INTERNAL_SFNT_H
 #include FT_OUTLINE_H
-#include FT_INTERNAL_POSTSCRIPT_HINTS_H
 
 #include "cffobjs.h"
 #include "cffload.h"
@@ -394,7 +393,7 @@
 
     /* initialize Type2 decoder */
     decoder->cff          = cff;
-    decoder->num_globals  = cff->num_global_subrs;
+    decoder->num_globals  = cff->global_subrs_index.count;
     decoder->globals      = cff->global_subrs;
     decoder->globals_bias = cff_compute_bias(
                               cff->top_font.font_dict.charstring_type,
@@ -430,7 +429,7 @@
         goto Exit;
       }
 
-      FT_TRACE4(( "glyph index %d (subfont %d):\n", glyph_index, fd_index ));
+      FT_TRACE3(( "glyph index %d (subfont %d):\n", glyph_index, fd_index ));
 
       sub = cff->subfonts[fd_index];
 
@@ -445,10 +444,10 @@
     }
 #ifdef FT_DEBUG_LEVEL_TRACE
     else
-      FT_TRACE4(( "glyph index %d:\n", glyph_index ));
+      FT_TRACE3(( "glyph index %d:\n", glyph_index ));
 #endif
 
-    decoder->num_locals    = sub->num_local_subrs;
+    decoder->num_locals    = sub->local_subrs_index.count;
     decoder->locals        = sub->local_subrs;
     decoder->locals_bias   = cff_compute_bias(
                                decoder->cff->top_font.font_dict.charstring_type,
@@ -812,10 +811,10 @@
                                              charstring_len );
       decoder->seac = FALSE;
 
+      cff_free_glyph_data( face, &charstring, charstring_len );
+
       if ( error )
         goto Exit;
-
-      cff_free_glyph_data( face, &charstring, charstring_len );
     }
 
     /* Save the left bearing, advance and glyph width of the base */
@@ -842,10 +841,10 @@
                                              charstring_len );
       decoder->seac = FALSE;
 
+      cff_free_glyph_data( face, &charstring, charstring_len );
+
       if ( error )
         goto Exit;
-
-      cff_free_glyph_data( face, &charstring, charstring_len );
     }
 
     /* Restore the left side bearing, advance and glyph width */
@@ -1340,6 +1339,14 @@
             decoder->num_hints += num_args / 2;
           }
 
+          /* In a valid charstring there must be at least one byte */
+          /* after `hintmask' or `cntrmask' (e.g., for a `return'  */
+          /* instruction).  Additionally, there must be space for  */
+          /* `num_hints' bits.                                     */
+
+          if ( ( ip + ( ( decoder->num_hints + 7 ) >> 3 ) ) >= limit )
+            goto Syntax_Error;
+
           if ( hinter )
           {
             if ( op == cff_op_hintmask )
@@ -1358,20 +1365,18 @@
             FT_UInt maskbyte;
 
 
-            FT_TRACE4(( " (maskbytes: " ));
+            FT_TRACE4(( " (maskbytes:" ));
 
             for ( maskbyte = 0;
-                  maskbyte < (FT_UInt)(( decoder->num_hints + 7 ) >> 3);
+                  maskbyte < (FT_UInt)( ( decoder->num_hints + 7 ) >> 3 );
                   maskbyte++, ip++ )
-              FT_TRACE4(( "0x%02X", *ip ));
+              FT_TRACE4(( " 0x%02X", *ip ));
 
             FT_TRACE4(( ")\n" ));
           }
 #else
           ip += ( decoder->num_hints + 7 ) >> 3;
 #endif
-          if ( ip >= limit )
-            goto Syntax_Error;
           args = stack;
           break;
 
@@ -2275,7 +2280,11 @@
           /* subsequent `pop' operands should add the arguments,       */
           /* this is the implementation described for `unknown' other  */
           /* subroutines in the Type1 spec.                            */
+          /*                                                           */
+          /* XXX Fix return arguments (see discussion below).          */
           args -= 2 + ( args[-2] >> 16 );
+          if ( args < stack )
+            goto Stack_Underflow;
           break;
 
         case cff_op_pop:
@@ -2285,6 +2294,22 @@
 
           FT_TRACE4(( " pop (invalid op)\n" ));
 
+          /* XXX Increasing `args' is wrong: After a certain number of */
+          /* `pop's we get a stack overflow.  Reason for doing it is   */
+          /* code like this (actually found in a CFF font):            */
+          /*                                                           */
+          /*   17 1 3 callothersubr                                    */
+          /*   pop                                                     */
+          /*   callsubr                                                */
+          /*                                                           */
+          /* Since we handle `callothersubr' as a no-op, and           */
+          /* `callsubr' needs at least one argument, `pop' can't be a  */
+          /* no-op too as it basically should be.                      */
+          /*                                                           */
+          /* The right solution would be to provide real support for   */
+          /* `callothersubr' as done in `t1decode.c', however, given   */
+          /* the fact that CFF fonts with `pop' are invalid, it is     */
+          /* questionable whether it is worth the time.                */
           args++;
           break;
 
@@ -2448,7 +2473,10 @@
           return CFF_Err_Unimplemented_Feature;
         }
 
-      decoder->top = args;
+        decoder->top = args;
+
+        if ( decoder->top - stack >= CFF_MAX_OPERANDS )
+          goto Stack_Overflow;
 
       } /* general operator processing */
 
@@ -2668,11 +2696,15 @@
     /* this scaling is only relevant if the PS hinter isn't active */
     if ( cff->num_subfonts )
     {
-      FT_Byte  fd_index = cff_fd_select_get( &cff->fd_select,
+      FT_ULong  top_upm, sub_upm;
-                                             glyph_index );
+      FT_Byte   fd_index = cff_fd_select_get( &cff->fd_select,
+                                              glyph_index );
 
-      FT_ULong  top_upm = cff->top_font.font_dict.units_per_em;
+      if ( fd_index >= cff->num_subfonts ) 
-      FT_ULong  sub_upm = cff->subfonts[fd_index]->font_dict.units_per_em;
+        fd_index = cff->num_subfonts - 1;
+
+      top_upm = cff->top_font.font_dict.units_per_em;
+      sub_upm = cff->subfonts[fd_index]->font_dict.units_per_em;
 
 
       font_matrix = cff->subfonts[fd_index]->font_dict.font_matrix;
@@ -2717,48 +2749,53 @@
       /* now load the unscaled outline */
       error = cff_get_glyph_data( face, glyph_index,
                                   &charstring, &charstring_len );
-      if ( !error )
+      if ( error )
-      {
+        goto Glyph_Build_Finished;
-        error = cff_decoder_prepare( &decoder, size, glyph_index );
-        if ( !error )
-        {
-          error = cff_decoder_parse_charstrings( &decoder,
-                                                 charstring,
-                                                 charstring_len );
 
-          cff_free_glyph_data( face, &charstring, charstring_len );
+      error = cff_decoder_prepare( &decoder, size, glyph_index );
+      if ( error )
+        goto Glyph_Build_Finished;
 
+      error = cff_decoder_parse_charstrings( &decoder,
+                                             charstring,
+                                             charstring_len );
+
+      cff_free_glyph_data( face, &charstring, charstring_len );
+
+      if ( error )
+        goto Glyph_Build_Finished;
 
 #ifdef FT_CONFIG_OPTION_INCREMENTAL
-          /* Control data and length may not be available for incremental */
+      /* Control data and length may not be available for incremental */
-          /* fonts.                                                       */
+      /* fonts.                                                       */
-          if ( face->root.internal->incremental_interface )
+      if ( face->root.internal->incremental_interface )
-          {
+      {
-            glyph->root.control_data = 0;
+        glyph->root.control_data = 0;
-            glyph->root.control_len = 0;
+        glyph->root.control_len = 0;
-          }
+      }
-          else
+      else
 #endif /* FT_CONFIG_OPTION_INCREMENTAL */
 
-          /* We set control_data and control_len if charstrings is loaded. */
+      /* We set control_data and control_len if charstrings is loaded. */
-          /* See how charstring loads at cff_index_access_element() in     */
+      /* See how charstring loads at cff_index_access_element() in     */
-          /* cffload.c.                                                    */
+      /* cffload.c.                                                    */
-          {
+      {
-            CFF_Index  csindex = &cff->charstrings_index;
+        CFF_Index  csindex = &cff->charstrings_index;
 
 
-            if ( csindex->offsets )
+        if ( csindex->offsets )
-            {
+        {
-              glyph->root.control_data = csindex->bytes +
+          glyph->root.control_data = csindex->bytes +
-                                           csindex->offsets[glyph_index] - 1;
+                                     csindex->offsets[glyph_index] - 1;
-              glyph->root.control_len  = charstring_len;
+          glyph->root.control_len  = charstring_len;
-            }
-          }
         }
       }
 
-      /* save new glyph tables */
+  Glyph_Build_Finished:
-      cff_builder_done( &decoder.builder );
+      /* save new glyph tables, if no error */
+      if ( !error )
+        cff_builder_done( &decoder.builder );
+      /* XXX: anything to do for broken glyph entry? */
     }
 
 #ifdef FT_CONFIG_OPTION_INCREMENTAL

src/libs/freetype2/cff/cffload.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    OpenType and CFF data/program tables loader (body).                  */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -20,7 +21,6 @@
 #include FT_INTERNAL_DEBUG_H
 #include FT_INTERNAL_OBJECTS_H
 #include FT_INTERNAL_STREAM_H
-#include FT_SERVICE_POSTSCRIPT_CMAPS_H
 #include FT_TRUETYPE_TAGS_H
 #include FT_TYPE1_TABLES_H
 
@@ -251,7 +251,7 @@
 
       if ( offsize < 1 || offsize > 4 )
       {
-        error = FT_Err_Invalid_Table;
+        error = CFF_Err_Invalid_Table;
         goto Exit;
       }
 
@@ -377,18 +377,21 @@
   }
 
 
-  /* allocate a table containing pointers to an index's elements */
+  /* Allocate a table containing pointers to an index's elements. */
+  /* The `pool' argument makes this function convert the index    */
+  /* entries to C-style strings (this is, NULL-terminated).       */
   static FT_Error
   cff_index_get_pointers( CFF_Index   idx,
-                          FT_Byte***  table )
+                          FT_Byte***  table,
+                          FT_Byte**   pool )
   {
-    FT_Error   error  = CFF_Err_Ok;
+    FT_Error   error     = CFF_Err_Ok;
-    FT_Memory  memory = idx->stream->memory;
+    FT_Memory  memory    = idx->stream->memory;
-    FT_ULong   n, offset, old_offset;
     FT_Byte**  t;
+    FT_Byte*   new_bytes = NULL;
 
 
-    *table = 0;
+    *table = NULL;
 
     if ( idx->offsets == NULL )
     {
@@ -397,28 +400,65 @@
         goto Exit;
     }
 
-    if ( idx->count > 0 && !FT_NEW_ARRAY( t, idx->count + 1 ) )
+    if ( idx->count > 0                                        &&
+         !FT_NEW_ARRAY( t, idx->count + 1 )                    &&
+         ( !pool || !FT_ALLOC( new_bytes,
+                               idx->data_size + idx->count ) ) )
     {
-      old_offset = 1;
+      FT_ULong  n, cur_offset;
-      for ( n = 0; n <= idx->count; n++ )
+      FT_ULong  extra = 0;
+      FT_Byte*  org_bytes = idx->bytes;
+
+
+      /* at this point, `idx->offsets' can't be NULL */
+      cur_offset = idx->offsets[0] - 1;
+
+      /* sanity check */
+      if ( cur_offset >= idx->data_size )
       {
-        /* at this point, `idx->offsets' can't be NULL */
+        FT_TRACE0(( "cff_index_get_pointers:"
-        offset = idx->offsets[n];
+                    " invalid first offset value %d set to zero\n",
-        if ( !offset )
+                    cur_offset ));
-          offset = old_offset;
+        cur_offset = 0;
+      }
 
-        /* two sanity checks for invalid offset tables */
+      if ( !pool )
-        else if ( offset < old_offset )
+        t[0] = org_bytes + cur_offset;
-          offset = old_offset;
+      else
+        t[0] = new_bytes + cur_offset;
 
-        else if ( offset - 1 >= idx->data_size && n < idx->count )
+      for ( n = 1; n <= idx->count; n++ )
-          offset = old_offset;
+      {
+        FT_ULong  next_offset = idx->offsets[n] - 1;
 
-        t[n] = idx->bytes + offset - 1;
 
-        old_offset = offset;
+        /* empty slot + two sanity checks for invalid offset tables */
+        if ( next_offset == 0                                    ||
+             next_offset < cur_offset                            ||
+             ( next_offset >= idx->data_size && n < idx->count ) )
+          next_offset = cur_offset;
+
+        if ( !pool )
+          t[n] = org_bytes + next_offset;
+        else
+        {
+          t[n] = new_bytes + next_offset + extra;
+
+          if ( next_offset != cur_offset )
+          {
+            FT_MEM_COPY( t[n - 1], org_bytes + cur_offset, t[n] - t[n - 1] );
+            t[n][0] = '\0';
+            t[n]   += 1;
+            extra++;
+          }
+        }
+
+        cur_offset = next_offset;
       }
       *table = t;
+
+      if ( pool )
+        *pool = new_bytes;
     }
 
   Exit:
@@ -526,10 +566,12 @@
   }
 
 
+  /* get an entry from Name INDEX */
   FT_LOCAL_DEF( FT_String* )
-  cff_index_get_name( CFF_Index  idx,
+  cff_index_get_name( CFF_Font  font,
-                      FT_UInt    element )
+                      FT_UInt   element )
   {
+    CFF_Index   idx = &font->name_index;
     FT_Memory   memory = idx->stream->memory;
     FT_Byte*    bytes;
     FT_ULong    byte_len;
@@ -553,42 +595,35 @@
   }
 
 
+  /* get an entry from String INDEX */
   FT_LOCAL_DEF( FT_String* )
-  cff_index_get_sid_string( CFF_Index           idx,
+  cff_index_get_string( CFF_Font  font,
-                            FT_UInt             sid,
+                        FT_UInt   element )
-                            FT_Service_PsCMaps  psnames )
+  {
+    return ( element < font->num_strings )
+             ? (FT_String*)font->strings[element]
+             : NULL;
+  }
+
+
+  FT_LOCAL_DEF( FT_String* )
+  cff_index_get_sid_string( CFF_Font  font,
+                            FT_UInt   sid )
   {
     /* value 0xFFFFU indicates a missing dictionary entry */
     if ( sid == 0xFFFFU )
-      return 0;
+      return NULL;
 
     /* if it is not a standard string, return it */
     if ( sid > 390 )
-      return cff_index_get_name( idx, sid - 391 );
+      return cff_index_get_string( font, sid - 391 );
 
     /* CID-keyed CFF fonts don't have glyph names */
-    if ( !psnames )
+    if ( !font->psnames )
-      return 0;
+      return NULL;
 
-    /* that's a standard string, fetch a copy from the PSName module */
+    /* this is a standard string */
-    {
+    return (FT_String *)font->psnames->adobe_std_strings( sid );
-      FT_String*   name       = 0;
-      const char*  adobe_name = psnames->adobe_std_strings( sid );
-
-
-      if ( adobe_name )
-      {
-        FT_Memory  memory = idx->stream->memory;
-        FT_Error   error;
-
-
-        (void)FT_STRDUP( name, adobe_name );
-
-        FT_UNUSED( error );
-      }
-
-      return name;
-    }
   }
 
 
@@ -734,7 +769,7 @@
                             FT_UInt      num_glyphs,
                             FT_Memory    memory )
   {
-    FT_Error   error   = FT_Err_Ok;
+    FT_Error   error   = CFF_Err_Ok;
     FT_UInt    i;
     FT_Long    j;
     FT_UShort  max_cid = 0;
@@ -894,14 +929,16 @@
 
             /* check whether the range contains at least one valid glyph; */
             /* the constant is given in the CFF specification             */
-            if ( glyph_sid >= 65000L ) {
+            if ( glyph_sid >= 65000L )
+            {
               FT_ERROR(( "cff_charset_load: invalid SID range\n" ));
               error = CFF_Err_Invalid_File_Format;
               goto Exit;
             }
 
             /* try to rescue some of the SIDs if `nleft' is too large */
-            if ( nleft > 65000L - 1L || glyph_sid >= 65000L - nleft ) {
+            if ( nleft > 65000L - 1L || glyph_sid >= 65000L - nleft )
+            {
               FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" ));
               nleft = ( FT_UInt )( 65000L - 1L - glyph_sid );
             }
@@ -1361,9 +1398,8 @@
       if ( error )
         goto Exit;
 
-      font->num_local_subrs = font->local_subrs_index.count;
       error = cff_index_get_pointers( &font->local_subrs_index,
-                                      &font->local_subrs );
+                                      &font->local_subrs, NULL );
       if ( error )
         goto Exit;
     }
@@ -1409,9 +1445,11 @@
     FT_Memory        memory = stream->memory;
     FT_ULong         base_offset;
     CFF_FontRecDict  dict;
+    CFF_IndexRec     string_index;
 
 
     FT_ZERO( font );
+    FT_ZERO( &string_index );
 
     font->stream = stream;
     font->memory = memory;
@@ -1438,15 +1476,20 @@
 
     /* read the name, top dict, string and global subrs index */
     if ( FT_SET_ERROR( cff_index_init( &font->name_index,
-                                       stream, 0 ) )              ||
+                                       stream, 0 ) )                  ||
          FT_SET_ERROR( cff_index_init( &font->font_dict_index,
-                                       stream, 0 ) )              ||
+                                       stream, 0 ) )                  ||
-         FT_SET_ERROR( cff_index_init( &font->string_index,
+         FT_SET_ERROR( cff_index_init( &string_index,
-                                       stream, 0 ) )              ||
+                                       stream, 1 ) )                  ||
          FT_SET_ERROR( cff_index_init( &font->global_subrs_index,
-                                       stream, 1 ) )              )
+                                       stream, 1 ) )                  ||
+         FT_SET_ERROR( cff_index_get_pointers( &string_index,
+                                               &font->strings,
+                                               &font->string_pool ) ) )
       goto Exit;
 
+    font->num_strings = string_index.count;
+
     /* well, we don't really forget the `disabled' fonts... */
     font->num_faces = font->name_index.count;
     if ( face_index >= (FT_Int)font->num_faces )
@@ -1542,12 +1585,10 @@
       goto Exit;
     }
 
-    /* explicit the global subrs */
+    font->num_glyphs = font->charstrings_index.count;
-    font->num_global_subrs = font->global_subrs_index.count;
-    font->num_glyphs       = font->charstrings_index.count;
 
     error = cff_index_get_pointers( &font->global_subrs_index,
-                                    &font->global_subrs ) ;
+                                    &font->global_subrs, NULL );
 
     if ( error )
       goto Exit;
@@ -1579,9 +1620,11 @@
 
     /* get the font name (/CIDFontName for CID-keyed fonts, */
     /* /FontName otherwise)                                 */
-    font->font_name = cff_index_get_name( &font->name_index, face_index );
+    font->font_name = cff_index_get_name( font, face_index );
 
   Exit:
+    cff_index_done( &string_index );
+
     return error;
   }
 
@@ -1594,7 +1637,6 @@
 
 
     cff_index_done( &font->global_subrs_index );
-    cff_index_done( &font->string_index );
     cff_index_done( &font->font_dict_index );
     cff_index_done( &font->name_index );
     cff_index_done( &font->charstrings_index );
@@ -1617,21 +1659,12 @@
 
     CFF_Done_FD_Select( &font->fd_select, font->stream );
 
-    if (font->font_info != NULL)
+    FT_FREE( font->font_info );
-    {
-      FT_FREE( font->font_info->version );
-      FT_FREE( font->font_info->notice );
-      FT_FREE( font->font_info->full_name );
-      FT_FREE( font->font_info->family_name );
-      FT_FREE( font->font_info->weight );
-      FT_FREE( font->font_info );
-    }
 
-    FT_FREE( font->registry );
-    FT_FREE( font->ordering );
-
-    FT_FREE( font->global_subrs );
     FT_FREE( font->font_name );
+    FT_FREE( font->global_subrs );
+    FT_FREE( font->strings );
+    FT_FREE( font->string_pool );
   }
 
 

src/libs/freetype2/cff/cffload.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    OpenType & CFF data/program tables loader (specification).           */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2007, 2008 by                         */
+/*  Copyright 1996-2001, 2002, 2003, 2007, 2008, 2010 by                   */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -22,7 +22,6 @@
 
 #include <ft2build.h>
 #include "cfftypes.h"
-#include FT_SERVICE_POSTSCRIPT_CMAPS_H
 
 
 FT_BEGIN_HEADER
@@ -32,13 +31,12 @@ FT_BEGIN_HEADER
 
 
   FT_LOCAL( FT_String* )
-  cff_index_get_name( CFF_Index  idx,
+  cff_index_get_string( CFF_Font  font,
-                      FT_UInt    element );
+                        FT_UInt   element );
 
   FT_LOCAL( FT_String* )
-  cff_index_get_sid_string( CFF_Index          idx,
+  cff_index_get_sid_string( CFF_Font  font,
-                            FT_UInt            sid,
+                            FT_UInt   sid );
-                            FT_Service_PsCMaps psnames );
 
 
   FT_LOCAL( FT_Error )
@@ -51,6 +49,10 @@ FT_BEGIN_HEADER
   cff_index_forget_element( CFF_Index  idx,
                             FT_Byte**  pbytes );
 
+  FT_LOCAL( FT_String* )
+  cff_index_get_name( CFF_Font  font,
+                      FT_UInt   element );
+
 
   FT_LOCAL( FT_UInt )
   cff_charset_cid_to_gindex( CFF_Charset  charset,

src/libs/freetype2/cff/cffobjs.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    OpenType objects manager (body).                                     */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -24,8 +25,6 @@
 #include FT_TRUETYPE_IDS_H
 #include FT_TRUETYPE_TAGS_H
 #include FT_INTERNAL_SFNT_H
-#include FT_SERVICE_POSTSCRIPT_CMAPS_H
-#include FT_INTERNAL_POSTSCRIPT_HINTS_H
 #include "cffobjs.h"
 #include "cffload.h"
 #include "cffcmap.h"
@@ -58,7 +57,7 @@
   {
     CFF_Face          face     = (CFF_Face)size->root.face;
     CFF_Font          font     = (CFF_Font)face->extra.data;
-    PSHinter_Service  pshinter = (PSHinter_Service)font->pshinter;
+    PSHinter_Service  pshinter = font->pshinter;
     FT_Module         module;
 
 
@@ -349,7 +348,7 @@
   {
     CFF_Face          face     = (CFF_Face)slot->face;
     CFF_Font          font     = (CFF_Font)face->extra.data;
-    PSHinter_Service  pshinter = (PSHinter_Service)font->pshinter;
+    PSHinter_Service  pshinter = font->pshinter;
 
 
     if ( pshinter )
@@ -395,6 +394,41 @@
   }
 
 
+  /* Strip all subset prefixes of the form `ABCDEF+'.  Usually, there */
+  /* is only one, but font names like `APCOOG+JFABTD+FuturaBQ-Bold'   */
+  /* have been seen in the wild.                                      */
+
+  static void
+  remove_subset_prefix( FT_String*  name )
+  {
+    FT_Int32  idx             = 0;
+    FT_Int32  length          = strlen( name ) + 1;
+    FT_Bool   continue_search = 1;
+ 
+
+    while ( continue_search )
+    {
+      if ( length >= 7 && name[6] == '+' )
+      {
+        for ( idx = 0; idx < 6; idx++ )
+        {
+          /* ASCII uppercase letters */
+          if ( !( 'A' <= name[idx] && name[idx] <= 'Z' ) )
+            continue_search = 0;
+        }
+
+        if ( continue_search )
+        {
+          for ( idx = 7; idx < length; idx++ )
+            name[idx - 7] = name[idx];
+        }
+      }
+      else
+        continue_search = 0;
+    }
+  }
+
+
   FT_LOCAL_DEF( FT_Error )
   cff_face_init( FT_Stream      stream,
                  FT_Face        cffface,        /* CFF_Face */
@@ -412,14 +446,6 @@
     FT_Library library = cffface->driver->root.library;
 
 
-#if 0
-    FT_FACE_FIND_GLOBAL_SERVICE( face, sfnt,     SFNT );
-    FT_FACE_FIND_GLOBAL_SERVICE( face, psnames,  POSTSCRIPT_NAMES );
-    FT_FACE_FIND_GLOBAL_SERVICE( face, pshinter, POSTSCRIPT_HINTER );
-
-    if ( !sfnt )
-      goto Bad_Format;
-#else
     sfnt = (SFNT_Service)FT_Get_Module_Interface(
              library, "sfnt" );
     if ( !sfnt )
@@ -429,7 +455,6 @@
 
     pshinter = (PSHinter_Service)FT_Get_Module_Interface(
                  library, "pshinter" );
-#endif
 
     /* create input stream from resource */
     if ( FT_STREAM_SEEK( 0 ) )
@@ -514,7 +539,7 @@
         goto Exit;
 
       cff->pshinter = pshinter;
-      cff->psnames  = (void*)psnames;
+      cff->psnames  = psnames;
 
       cffface->face_index = face_index;
 
@@ -678,24 +703,22 @@
           (FT_Short)( dict->underline_thickness >> 16 );
 
         /* retrieve font family & style name */
-        cffface->family_name = cff_index_get_name( &cff->name_index,
+        cffface->family_name = cff_index_get_name( cff, face_index );
-                                                   face_index );
-
         if ( cffface->family_name )
         {
-          char*  full   = cff_index_get_sid_string( &cff->string_index,
+          char*  full   = cff_index_get_sid_string( cff,
-                                                    dict->full_name,
+                                                    dict->full_name );
-                                                    psnames );
           char*  fullp  = full;
           char*  family = cffface->family_name;
-          char*  family_name = 0;
+          char*  family_name = NULL;
 
 
+          remove_subset_prefix( cffface->family_name ); 
+
           if ( dict->family_name )
           {
-            family_name = cff_index_get_sid_string( &cff->string_index,
+            family_name = cff_index_get_sid_string( cff,
-                                                    dict->family_name,
+                                                    dict->family_name );
-                                                    psnames);
             if ( family_name )
               family = family_name;
           }
@@ -738,23 +761,18 @@
               }
               break;
             }
-
-            if ( family_name )
-              FT_FREE( family_name );
-            FT_FREE( full );
           }
         }
         else
         {
           char  *cid_font_name =
-                   cff_index_get_sid_string( &cff->string_index,
+                   cff_index_get_sid_string( cff,
-                                             dict->cid_font_name,
+                                             dict->cid_font_name );
-                                             psnames );
 
 
           /* do we have a `/FontName' for a CID-keyed font? */
           if ( cid_font_name )
-            cffface->family_name = cid_font_name;
+            cffface->family_name = cff_strcpy( memory, cid_font_name );
         }
 
         if ( style_name )
@@ -797,16 +815,14 @@
           flags |= FT_STYLE_FLAG_ITALIC;
 
         {
-          char  *weight = cff_index_get_sid_string( &cff->string_index,
+          char  *weight = cff_index_get_sid_string( cff,
-                                                    dict->weight,
+                                                    dict->weight );
-                                                    psnames );
 
 
           if ( weight )
             if ( !ft_strcmp( weight, "Bold"  ) ||
                  !ft_strcmp( weight, "Black" ) )
               flags |= FT_STYLE_FLAG_BOLD;
-          FT_FREE( weight );
         }
 
         /* double check */
@@ -849,13 +865,14 @@
         {
           cmap = cffface->charmaps[nn];
 
-          /* Windows Unicode (3,1)? */
+          /* Windows Unicode? */
-          if ( cmap->platform_id == 3 && cmap->encoding_id == 1 )
+          if ( cmap->platform_id == TT_PLATFORM_MICROSOFT &&
+               cmap->encoding_id == TT_MS_ID_UNICODE_CS   )
             goto Skip_Unicode;
 
-          /* Deprecated Unicode platform id? */
+          /* Apple Unicode platform id? */
-          if ( cmap->platform_id == 0 )
+          if ( cmap->platform_id == TT_PLATFORM_APPLE_UNICODE )
-            goto Skip_Unicode; /* Standard Unicode (deprecated) */
+            goto Skip_Unicode; /* Apple Unicode */
         }
 
         /* since CID-keyed fonts don't contain glyph names, we can't */
@@ -863,28 +880,51 @@
         if ( pure_cff && cff->top_font.font_dict.cid_registry != 0xFFFFU )
           goto Exit;
 
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( nn + 1 > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "cff_face_init: no Unicode cmap is found, "
+                     "and too many subtables (%d) to add synthesized cmap\n",
+                     nn ));
+          goto Exit;
+        }
+#endif
+
         /* we didn't find a Unicode charmap -- synthesize one */
         cmaprec.face        = cffface;
-        cmaprec.platform_id = 3;
+        cmaprec.platform_id = TT_PLATFORM_MICROSOFT;
-        cmaprec.encoding_id = 1;
+        cmaprec.encoding_id = TT_MS_ID_UNICODE_CS;
         cmaprec.encoding    = FT_ENCODING_UNICODE;
 
         nn = (FT_UInt)cffface->num_charmaps;
 
-        FT_CMap_New( &FT_CFF_CMAP_UNICODE_CLASS_REC_GET, NULL, &cmaprec, NULL );
+        error = FT_CMap_New( &FT_CFF_CMAP_UNICODE_CLASS_REC_GET, NULL,
+                             &cmaprec, NULL );
+        if ( error && FT_Err_No_Unicode_Glyph_Name != error )
+          goto Exit;
+        error = FT_Err_Ok;
 
         /* if no Unicode charmap was previously selected, select this one */
         if ( cffface->charmap == NULL && nn != (FT_UInt)cffface->num_charmaps )
           cffface->charmap = cffface->charmaps[nn];
 
       Skip_Unicode:
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+        if ( nn > FT_MAX_CHARMAP_CACHEABLE )
+        {
+          FT_ERROR(( "cff_face_init: Unicode cmap is found, "
+                     "but too many preceding subtables (%d) to access\n",
+                     nn - 1 ));
+          goto Exit;
+        }
+#endif
         if ( encoding->count > 0 )
         {
           FT_CMap_Class  clazz;
 
 
           cmaprec.face        = cffface;
-          cmaprec.platform_id = 7;  /* Adobe platform id */
+          cmaprec.platform_id = TT_PLATFORM_ADOBE;  /* Adobe platform id */
 
           if ( encoding->offset == 0 )
           {
@@ -905,7 +945,7 @@
             clazz               = &FT_CFF_CMAP_ENCODING_CLASS_REC_GET;
           }
 
-          FT_CMap_New( clazz, NULL, &cmaprec, NULL );
+          error = FT_CMap_New( clazz, NULL, &cmaprec, NULL );
         }
       }
     }

src/libs/freetype2/cff/cffparse.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    CFF token stream parser (body)                                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2007, 2008, 2009 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2007, 2008, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -137,26 +137,23 @@
     FT_UInt   nib;
     FT_UInt   phase;
 
-    FT_Long   result, number, rest, exponent;
+    FT_Long   result, number, exponent;
     FT_Int    sign = 0, exponent_sign = 0;
     FT_Long   exponent_add, integer_length, fraction_length;
 
 
     if ( scaling )
-      *scaling  = 0;
+      *scaling = 0;
 
     result = 0;
 
     number   = 0;
-    rest     = 0;
     exponent = 0;
 
     exponent_add    = 0;
     integer_length  = 0;
     fraction_length = 0;
 
-    FT_UNUSED( rest );
-
     /* First of all, read the integer part. */
     phase = 4;
 
@@ -332,11 +329,19 @@
         goto Exit;
 
       /* Remove non-significant digits. */
-      if ( integer_length < 0 ) {
+      if ( integer_length < 0 )
+      {
         number          /= power_tens[-integer_length];
         fraction_length += integer_length;
       }
 
+      /* this can only happen if exponent was non-zero */
+      if ( fraction_length == 10 )
+      {
+        number          /= 10;
+        fraction_length -= 1;
+      }
+
       /* Convert into 16.16 format. */
       if ( fraction_length > 0 )
       {
@@ -702,7 +707,7 @@
     clazz[i].count_offset = 0;
 
     *output_class = clazz;
-    return FT_Err_Ok;
+    return CFF_Err_Ok;
   }
 
 

src/libs/freetype2/cff/cffpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for cff module.      */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -59,18 +59,20 @@
     }
   }
 
+
   FT_Error
-  cff_driver_class_pic_init(  FT_Library library )
+  cff_driver_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = CFF_Err_Ok;
-    CffModulePIC* container;
+    CffModulePIC*      container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->cff = container;
 
     /* initialize pointer table - this is how the module usually expects this data */

src/libs/freetype2/cff/cfftypes.h

@@ -5,7 +5,7 @@
 /*    Basic OpenType/CFF type definitions and interface (specification     */
 /*    only).                                                               */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2006, 2007, 2008 by                   */
+/*  Copyright 1996-2001, 2002, 2003, 2006, 2007, 2008, 2010 by             */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -24,6 +24,9 @@
 #include <ft2build.h>
 #include FT_FREETYPE_H
 #include FT_TYPE1_TABLES_H
+#include FT_INTERNAL_SERVICE_H
+#include FT_SERVICE_POSTSCRIPT_CMAPS_H
+#include FT_INTERNAL_POSTSCRIPT_HINTS_H
 
 
 FT_BEGIN_HEADER
@@ -204,8 +207,7 @@ FT_BEGIN_HEADER
     CFF_PrivateRec      private_dict;
 
     CFF_IndexRec        local_subrs_index;
-    FT_UInt             num_local_subrs;
+    FT_Byte**           local_subrs; /* array of pointers into Local Subrs INDEX data */
-    FT_Byte**           local_subrs;
 
   } CFF_SubFontRec, *CFF_SubFont;
 
@@ -229,7 +231,6 @@ FT_BEGIN_HEADER
 
     CFF_IndexRec     name_index;
     CFF_IndexRec     top_dict_index;
-    CFF_IndexRec     string_index;
     CFF_IndexRec     global_subrs_index;
 
     CFF_EncodingRec  encoding;
@@ -241,9 +242,15 @@ FT_BEGIN_HEADER
     CFF_IndexRec     local_subrs_index;
 
     FT_String*       font_name;
-    FT_UInt          num_global_subrs;
+
+    /* array of pointers into Global Subrs INDEX data */
     FT_Byte**        global_subrs;
 
+    /* array of pointers into String INDEX data stored at string_pool */
+    FT_UInt          num_strings;
+    FT_Byte**        strings;
+    FT_Byte*         string_pool;
+
     CFF_SubFontRec   top_font;
     FT_UInt          num_subfonts;
     CFF_SubFont      subfonts[CFF_MAX_CID_FONTS];
@@ -251,10 +258,10 @@ FT_BEGIN_HEADER
     CFF_FDSelectRec  fd_select;
 
     /* interface to PostScript hinter */
-    void*            pshinter;
+    PSHinter_Service  pshinter;
 
     /* interface to Postscript Names service */
-    void*            psnames;
+    FT_Service_PsCMaps  psnames;
 
     /* since version 2.3.0 */
     PS_FontInfoRec*  font_info;   /* font info dictionary */

src/libs/freetype2/cid/cidobjs.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    CID objects manager (body).                                          */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2008, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -131,7 +131,7 @@
   cid_size_init( FT_Size  cidsize )     /* CID_Size */
   {
     CID_Size           size  = (CID_Size)cidsize;
-    FT_Error           error = 0;
+    FT_Error           error = CID_Err_Ok;
     PSH_Globals_Funcs  funcs = cid_size_get_globals_funcs( size );
 
 

src/libs/freetype2/gzip/ftgzip.c

@@ -8,7 +8,7 @@
 /*  parse compressed PCF fonts, as found with many X11 server              */
 /*  distributions.                                                         */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2009 by                        */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2009, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -107,7 +107,7 @@
   {
     FT_ULong    sz = (FT_ULong)size * items;
     FT_Error    error;
-    FT_Pointer  p;
+    FT_Pointer  p  = NULL;
 
 
     (void)FT_ALLOC( p, sz );
@@ -390,7 +390,7 @@
   ft_gzip_file_fill_output( FT_GZipFile  zip )
   {
     z_stream*  zstream = &zip->zstream;
-    FT_Error   error   = 0;
+    FT_Error   error   = Gzip_Err_Ok;
 
 
     zip->cursor        = zip->buffer;
@@ -656,7 +656,7 @@
           ft_gzip_file_io( zip, 0, NULL, 0 );
           FT_FREE( zip_buff );
         }
-        error = 0;
+        error = Gzip_Err_Ok;
       }
     }
 

src/libs/freetype2/lzw/ftlzw.c

@@ -171,7 +171,7 @@
   {
     FT_LzwState  lzw = &zip->lzw;
     FT_ULong     count;
-    FT_Error     error   = 0;
+    FT_Error     error = LZW_Err_Ok;
 
 
     zip->cursor = zip->buffer;

src/libs/freetype2/otvalid/otvmath.c

@@ -248,7 +248,8 @@
       otv_MathItalicsCorrectionInfo_validate(
         table + MathTopAccentAttachment, valid, FALSE );
 
-    if ( ExtendedShapeCoverage ) {
+    if ( ExtendedShapeCoverage )
+    {
       OTV_NAME_ENTER( "ExtendedShapeCoverage" );
       otv_Coverage_validate( table + ExtendedShapeCoverage, valid, -1 );
       OTV_EXIT;

src/libs/freetype2/otvalid/otvmod.c

@@ -214,7 +214,8 @@
     *ot_jstf = (FT_Bytes)jstf;
 
   Exit:
-    if ( error ) {
+    if ( error )
+    {
       FT_Memory  memory = FT_FACE_MEMORY( face );
 
 
@@ -224,6 +225,7 @@
       FT_FREE( gsub );
       FT_FREE( jstf );
     }
+
     {
       FT_Memory  memory = FT_FACE_MEMORY( face );
 

src/libs/freetype2/pcf/pcfdrivr.c

@@ -34,6 +34,7 @@ THE SOFTWARE.
 #include FT_LZW_H
 #include FT_ERRORS_H
 #include FT_BDF_H
+#include FT_TRUETYPE_IDS_H 
 
 #include "pcf.h"
 #include "pcfdrivr.h"
@@ -227,7 +228,8 @@ THE SOFTWARE.
         {
           prop = &face->properties[i];
 
-          if ( prop ) {
+          if ( prop )
+          {
             FT_FREE( prop->name );
             if ( prop->isString )
               FT_FREE( prop->value.atom );
@@ -358,14 +360,15 @@ THE SOFTWARE.
 
         charmap.face        = FT_FACE( face );
         charmap.encoding    = FT_ENCODING_NONE;
-        charmap.platform_id = 0;
+        /* initial platform/encoding should indicate unset status? */
-        charmap.encoding_id = 0;
+        charmap.platform_id = TT_PLATFORM_APPLE_UNICODE;
+        charmap.encoding_id = TT_APPLE_ID_DEFAULT;
 
         if ( unicode_charmap )
         {
           charmap.encoding    = FT_ENCODING_UNICODE;
-          charmap.platform_id = 3;
+          charmap.platform_id = TT_PLATFORM_MICROSOFT;
-          charmap.encoding_id = 1;
+          charmap.encoding_id = TT_MS_ID_UNICODE_CS;
         }
 
         error = FT_CMap_New( &pcf_cmap_class, NULL, &charmap, NULL );

src/libs/freetype2/pcf/pcfread.c

@@ -2,7 +2,8 @@
 
     FreeType font driver for pcf fonts
 
-  Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by
+  Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
+            2010 by
   Francesco Zappa Nardelli
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
@@ -607,6 +608,9 @@ THE SOFTWARE.
 
     face->nmetrics = nmetrics;
 
+    if ( !nmetrics )
+      return PCF_Err_Invalid_Table;
+
     FT_TRACE4(( "pcf_get_metrics:\n" ));
 
     FT_TRACE4(( "  number of metrics: %d\n", nmetrics ));

src/libs/freetype2/pfr/pfrdrivr.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR driver interface (body).                                */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2006, 2008 by                              */
+/*  Copyright 2002, 2003, 2004, 2006, 2008, 2010 by                        */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -84,7 +84,7 @@
       if ( gindex < phys->num_chars )
       {
         *anadvance = phys->chars[gindex].advance;
-        error = 0;
+        error = PFR_Err_Ok;
       }
     }
 

src/libs/freetype2/pfr/pfrgload.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR glyph loader (body).                                    */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2005, 2007 by                                    */
+/*  Copyright 2002, 2003, 2005, 2007, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -248,7 +248,7 @@
                          FT_Byte*   p,
                          FT_Byte*   limit )
   {
-    FT_Error   error  = 0;
+    FT_Error   error  = PFR_Err_Ok;
     FT_Memory  memory = glyph->loader->memory;
     FT_UInt    flags, x_count, y_count, i, count, mask;
     FT_Int     x;
@@ -268,8 +268,8 @@
     {
       PFR_CHECK( 1 );
       count   = PFR_NEXT_BYTE( p );
-      x_count = ( count & 15 );
+      x_count = count & 15;
-      y_count = ( count >> 4 );
+      y_count = count >> 4;
     }
     else
     {
@@ -388,7 +388,7 @@
 
         case 2:                             /* horizontal line to */
           FT_TRACE6(( "- horizontal line to cx.%d", format_low ));
-          if ( format_low > x_count )
+          if ( format_low >= x_count )
             goto Failure;
           pos[0].x   = glyph->x_control[format_low];
           pos[0].y   = pos[3].y;
@@ -398,7 +398,7 @@
 
         case 3:                             /* vertical line to */
           FT_TRACE6(( "- vertical line to cy.%d", format_low ));
-          if ( format_low > y_count )
+          if ( format_low >= y_count )
             goto Failure;
           pos[0].x   = pos[3].x;
           pos[0].y   = glyph->y_control[format_low];
@@ -440,7 +440,7 @@
           case 0:                           /* 8-bit index */
             PFR_CHECK( 1 );
             idx  = PFR_NEXT_BYTE( p );
-            if ( idx > x_count )
+            if ( idx >= x_count )
               goto Failure;
             cur->x = glyph->x_control[idx];
             FT_TRACE7(( " cx#%d", idx ));
@@ -470,7 +470,7 @@
           case 0:                           /* 8-bit index */
             PFR_CHECK( 1 );
             idx  = PFR_NEXT_BYTE( p );
-            if ( idx > y_count )
+            if ( idx >= y_count )
               goto Failure;
             cur->y = glyph->y_control[idx];
             FT_TRACE7(( " cy#%d", idx ));
@@ -558,7 +558,7 @@
                            FT_Byte*   p,
                            FT_Byte*   limit )
   {
-    FT_Error        error  = 0;
+    FT_Error        error  = PFR_Err_Ok;
     FT_GlyphLoader  loader = glyph->loader;
     FT_Memory       memory = loader->memory;
     PFR_SubGlyph    subglyph;
@@ -598,6 +598,16 @@
       FT_UInt  new_max = ( org_count + count + 3 ) & (FT_UInt)-4;
 
 
+      /* we arbitrarily limit the number of subglyphs */
+      /* to avoid endless recursion                   */
+      if ( new_max > 64 )
+      {
+        error = PFR_Err_Invalid_Table;
+        FT_ERROR(( "pfr_glyph_load_compound:"
+                   " too many compound glyphs components\n" ));
+        goto Exit;
+      }
+
       if ( FT_RENEW_ARRAY( glyph->subs, glyph->max_subs, new_max ) )
         goto Exit;
 
@@ -743,6 +753,9 @@
 
       count = glyph->num_subs - old_count;
 
+      FT_TRACE4(( "compound glyph with %d elements (offset %lu):\n",
+                  count, offset ));
+
       /* now, load each individual glyph */
       for ( n = 0; n < count; n++ )
       {
@@ -750,6 +763,8 @@
         PFR_SubGlyph  subglyph;
 
 
+        FT_TRACE4(( "subglyph %d:\n", n ));
+
         subglyph   = glyph->subs + old_count + n;
         old_points = base->n_points;
 
@@ -757,7 +772,7 @@
                                     subglyph->gps_offset,
                                     subglyph->gps_size );
         if ( error )
-          goto Exit;
+          break;
 
         /* note that `glyph->subs' might have been re-allocated */
         subglyph   = glyph->subs + old_count + n;
@@ -791,9 +806,13 @@
 
         /* proceed to next sub-glyph */
       }
+
+      FT_TRACE4(( "end compound glyph with %d elements\n", count ));
     }
     else
     {
+      FT_TRACE4(( "simple glyph (offset %lu)\n", offset ));
+
       /* load a simple glyph */
       error = pfr_glyph_load_simple( glyph, p, limit );
 
@@ -805,9 +824,6 @@
   }
 
 
-
-
-
   FT_LOCAL_DEF( FT_Error )
   pfr_glyph_load( PFR_Glyph  glyph,
                   FT_Stream  stream,

src/libs/freetype2/pfr/pfrload.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR loader (body).                                          */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2007, 2009 by                        */
+/*  Copyright 2002, 2003, 2004, 2005, 2007, 2009, 2010 by                  */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -49,7 +49,7 @@
                          PFR_ExtraItem   item_list,
                          FT_Pointer      item_data )
   {
-    FT_Error  error = 0;
+    FT_Error  error = PFR_Err_Ok;
     FT_Byte*  p     = *pp;
     FT_UInt   num_items, item_type, item_size;
 
@@ -353,7 +353,7 @@
     PFR_Strike  strike;
     FT_UInt     flags0;
     FT_UInt     n, count, size1;
-    FT_Error    error = 0;
+    FT_Error    error = PFR_Err_Ok;
 
 
     PFR_CHECK( 5 );
@@ -449,7 +449,7 @@
                                FT_Byte*     limit,
                                PFR_PhyFont  phy_font )
   {
-    FT_Error    error  = 0;
+    FT_Error    error  = PFR_Err_Ok;
     FT_Memory   memory = phy_font->memory;
     FT_PtrDist  len    = limit - p;
 
@@ -477,7 +477,7 @@
   {
     FT_UInt    count, num_vert, num_horz;
     FT_Int*    snaps;
-    FT_Error   error  = 0;
+    FT_Error   error  = PFR_Err_Ok;
     FT_Memory  memory = phy_font->memory;
 
 
@@ -520,8 +520,8 @@
                                      FT_Byte*     limit,
                                      PFR_PhyFont  phy_font )
   {
-    PFR_KernItem  item;
+    PFR_KernItem  item   = NULL;
-    FT_Error      error  = 0;
+    FT_Error      error  = PFR_Err_Ok;
     FT_Memory     memory = phy_font->memory;
 
 
@@ -631,7 +631,7 @@
                      FT_Memory    memory,
                      FT_String*  *astring )
   {
-    FT_Error    error = 0;
+    FT_Error    error = PFR_Err_Ok;
     FT_String*  result = NULL;
     FT_UInt     n, ok;
 

src/libs/freetype2/pfr/pfrobjs.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR object methods (body).                                  */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008 by                  */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2010 by            */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -23,6 +23,7 @@
 #include "pfrsbit.h"
 #include FT_OUTLINE_H
 #include FT_INTERNAL_DEBUG_H
+#include FT_TRUETYPE_IDS_H 
 
 #include "pfrerror.h"
 
@@ -147,7 +148,16 @@
             break;
 
         if ( nn == phy_font->num_chars )
-          pfrface->face_flags = 0;        /* not scalable */
+        {
+          if ( phy_font->num_strikes > 0 )
+            pfrface->face_flags = 0;        /* not scalable */
+          else
+          {
+            FT_ERROR(( "pfr_face_init: font doesn't contain glyphs\n" ));
+            error = PFR_Err_Invalid_File_Format;
+            goto Exit;
+          }
+        }
       }
 
       if ( (phy_font->flags & PFR_PHY_PROPORTIONAL) == 0 )
@@ -243,11 +253,11 @@
 
 
         charmap.face        = pfrface;
-        charmap.platform_id = 3;
+        charmap.platform_id = TT_PLATFORM_MICROSOFT;
-        charmap.encoding_id = 1;
+        charmap.encoding_id = TT_MS_ID_UNICODE_CS;
         charmap.encoding    = FT_ENCODING_UNICODE;
 
-        FT_CMap_New( &pfr_cmap_class_rec, NULL, &charmap, NULL );
+        error = FT_CMap_New( &pfr_cmap_class_rec, NULL, &charmap, NULL );
 
 #if 0
         /* Select default charmap */

src/libs/freetype2/pfr/pfrsbit.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType PFR bitmap loader (body).                                   */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2006, 2009 by                                    */
+/*  Copyright 2002, 2003, 2006, 2009, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -353,7 +353,7 @@
                            FT_Long   *aadvance,
                            FT_UInt   *aformat )
   {
-    FT_Error  error = 0;
+    FT_Error  error = PFR_Err_Ok;
     FT_Byte   flags;
     FT_Char   b;
     FT_Byte*  p = *pdata;
@@ -484,7 +484,7 @@
                         FT_Bool     decreasing,
                         FT_Bitmap*  target )
   {
-    FT_Error          error = 0;
+    FT_Error          error = PFR_Err_Ok;
     PFR_BitWriterRec  writer;
 
 

src/libs/freetype2/psaux/afmparse.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    AFM parser (body).                                                   */
 /*                                                                         */
-/*  Copyright 2006, 2007, 2008, 2009 by                                    */
+/*  Copyright 2006, 2007, 2008, 2009, 2010 by                              */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -527,7 +527,7 @@
                    FT_Byte*    base,
                    FT_Byte*    limit )
   {
-    AFM_Stream  stream;
+    AFM_Stream  stream = NULL;
     FT_Error    error;
 
 

src/libs/freetype2/psaux/afmparse.h

@@ -56,7 +56,8 @@ FT_BEGIN_HEADER
   typedef struct  AFM_ValueRec_
   {
     enum AFM_ValueType_  type;
-    union {
+    union
+    {
       char*     s;
       FT_Fixed  f;
       FT_Int    i;

src/libs/freetype2/psaux/psobjs.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    Auxiliary functions for PostScript fonts (body).                     */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -1588,6 +1589,13 @@
     FT_Error     error;
 
 
+    /* this might happen in invalid fonts */
+    if ( !outline )
+    {
+      FT_ERROR(( "t1_builder_add_contour: no outline to add points to\n" ));
+      return PSaux_Err_Invalid_File_Format;
+    }
+
     if ( !builder->load_points )
     {
       outline->n_contours++;
@@ -1621,7 +1629,7 @@
 
     if ( builder->parse_state == T1_Parse_Have_Path )
       error = PSaux_Err_Ok;
-    else if ( builder->parse_state == T1_Parse_Have_Moveto )
+    else
     {
       builder->parse_state = T1_Parse_Have_Path;
       error = t1_builder_add_contour( builder );

src/libs/freetype2/psaux/t1decode.c

@@ -777,6 +777,8 @@
           }
 
           /* the two `results' are popped by the following setcurrentpoint */
+          top[0] = x;
+          top[1] = y;
           known_othersubr_result_cnt = 2;
           break;
 
@@ -1480,8 +1482,12 @@
             goto Syntax_Error;
           }
           else
+            ...
 #endif
-            decoder->flex_state = 0;
+
+          x = top[0];
+          y = top[1];
+          decoder->flex_state = 0;
           break;
 
         case op_unknown15:

src/libs/freetype2/pshinter/pshalgo.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    PostScript hinting algorithm (body).                                 */
 /*                                                                         */
-/*  Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by      */
+/*  Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010   */
+/*            by                                                           */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used        */
@@ -1690,7 +1691,10 @@
     /* process secondary hints to `selected' points */
     if ( num_masks > 1 && glyph->num_points > 0 )
     {
-      first = mask->end_point;
+      /* the `endchar' op can reduce the number of points */
+      first = mask->end_point > glyph->num_points
+                ? glyph->num_points
+                : mask->end_point;
       mask++;
       for ( ; num_masks > 1; num_masks--, mask++ )
       {
@@ -1698,7 +1702,9 @@
         FT_Int   count;
 
 
-        next  = mask->end_point;
+        next  = mask->end_point > glyph->num_points
+                  ? glyph->num_points
+                  : mask->end_point;
         count = next - first;
         if ( count > 0 )
         {

src/libs/freetype2/pshinter/pshglob.c

@@ -5,7 +5,7 @@
 /*    PostScript hinter global hinting management (body).                  */
 /*    Inspired by the new auto-hinter module.                              */
 /*                                                                         */
-/*  Copyright 2001, 2002, 2003, 2004, 2006 by                              */
+/*  Copyright 2001, 2002, 2003, 2004, 2006, 2010 by                        */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used        */
@@ -624,7 +624,7 @@
                    T1_Private*   priv,
                    PSH_Globals  *aglobals )
   {
-    PSH_Globals  globals;
+    PSH_Globals  globals = NULL;
     FT_Error     error;
 
 

src/libs/freetype2/pshinter/pshpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for pshinter module. */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -38,18 +38,20 @@
     }
   }
 
+
   FT_Error
-  pshinter_module_class_pic_init( FT_Library library )
+  pshinter_module_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = PSH_Err_Ok;
-    PSHinterPIC*  container;
+    PSHinterPIC*       container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->pshinter = container;
     
     /* add call to initialization function when you add new scripts */

src/libs/freetype2/psnames/psmodule.c

@@ -366,11 +366,13 @@
 
       if ( count == 0 )
       {
+        /* No unicode chars here! */
         FT_FREE( table->maps );
         if ( !error )
-          error = PSnames_Err_Invalid_Argument;  /* No unicode chars here! */
+          error = PSnames_Err_No_Unicode_Glyph_Name;
       }
-      else {
+      else
+      {
         /* Reallocate if the number of used entries is much smaller. */
         if ( count < num_glyphs / 2 )
         {

src/libs/freetype2/psnames/pspic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for psnames module.  */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -44,13 +44,15 @@
     }
   }
 
+
   FT_Error
-  psnames_module_class_pic_init(  FT_Library library )
+  psnames_module_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = PSnames_Err_Ok;
-    PSModulePIC* container;
+    PSModulePIC*       container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )

src/libs/freetype2/raster/ftmisc.h

@@ -5,7 +5,7 @@
 /*    Miscellaneous macros for stand-alone rasterizer (specification       */
 /*    only).                                                               */
 /*                                                                         */
-/*  Copyright 2005, 2009 by                                                */
+/*  Copyright 2005, 2009, 2010 by                                          */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used        */
@@ -27,6 +27,7 @@
 #ifndef __FTMISC_H__
 #define __FTMISC_H__
 
+
   /* memset */
 #include FT_CONFIG_STANDARD_LIBRARY_H
 
@@ -35,6 +36,7 @@
 
 #define FT_LOCAL_DEF( x )   static x
 
+
   /* from include/freetype2/fttypes.h */
 
   typedef unsigned char  FT_Byte;
@@ -77,12 +79,22 @@
 
   } FT_MemoryRec;
 
+
   /* from src/ftcalc.c */
 
-#include <inttypes.h>
+#if ( defined _WIN32 || defined _WIN64 )
+
+  typedef __int64  FT_Int64;
+
+#else
+
+#include "inttypes.h"
 
   typedef int64_t  FT_Int64;
 
+#endif
+
+
   static FT_Long
   FT_MulDiv( FT_Long  a,
              FT_Long  b,

src/libs/freetype2/raster/ftraster.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType glyph rasterizer (body).                                */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2005, 2007, 2008, 2009 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2005, 2007, 2008, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -1122,13 +1122,13 @@
 
     if ( Dx > 0 )
     {
-      Ix = ( ras.precision * Dx ) / Dy;
+      Ix = SMulDiv( ras.precision, Dx,  Dy);
       Rx = ( ras.precision * Dx ) % Dy;
       Dx = 1;
     }
     else
     {
-      Ix = -( ( ras.precision * -Dx ) / Dy );
+      Ix = SMulDiv( ras.precision, -Dx,  Dy) * -1;
       Rx =    ( ras.precision * -Dx ) % Dy;
       Dx = -1;
     }
@@ -1931,18 +1931,21 @@
           y1 = SCALED( point[-2].y );
           x2 = SCALED( point[-1].x );
           y2 = SCALED( point[-1].y );
-          x3 = SCALED( point[ 0].x );
-          y3 = SCALED( point[ 0].y );
 
           if ( flipped )
           {
             SWAP_( x1, y1 );
             SWAP_( x2, y2 );
-            SWAP_( x3, y3 );
           }
 
           if ( point <= limit )
           {
+            x3 = SCALED( point[0].x );
+            y3 = SCALED( point[0].y );
+
+            if ( flipped )
+              SWAP_( x3, y3 );
+
             if ( Cubic_To( RAS_VARS x1, y1, x2, y2, x3, y3 ) )
               goto Fail;
             continue;
@@ -2495,7 +2498,7 @@
           PByte  p;
 
 
-          p = bits - e1*ras.target.pitch;
+          p = bits - e1 * ras.target.pitch;
           if ( ras.target.pitch > 0 )
             p += ( ras.target.rows - 1 ) * ras.target.pitch;
 
@@ -3400,7 +3403,7 @@
   }
 
 
-#else /* _STANDALONE_ */
+#else /* !_STANDALONE_ */
 
 
   static int
@@ -3408,7 +3411,7 @@
                 PRaster    *araster )
   {
     FT_Error  error;
-    PRaster   raster;
+    PRaster   raster = NULL;
 
 
     *araster = 0;
@@ -3432,7 +3435,7 @@
   }
 
 
-#endif /* _STANDALONE_ */
+#endif /* !_STANDALONE_ */
 
 
   static void
@@ -3447,9 +3450,8 @@
         PWorker  worker = (PWorker)pool_base;
 
 
-        raster->buffer      = pool_base + ( (sizeof ( *worker ) + 7 ) & ~7 );
+        raster->buffer      = pool_base + ( ( sizeof ( *worker ) + 7 ) & ~7 );
-        raster->buffer_size = ( ( pool_base + pool_size ) -
+        raster->buffer_size = pool_base + pool_size - (char*)raster->buffer;
-                                (char*)raster->buffer ) / sizeof ( Long );
         raster->worker      = worker;
       }
       else

src/libs/freetype2/raster/rastpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for raster module.   */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -43,16 +43,17 @@
 
 
   FT_Error
-  ft_raster1_renderer_class_pic_init(  FT_Library library )
+  ft_raster1_renderer_class_pic_init( FT_Library library )
   {
     FT_PIC_Container* pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error          error         = Raster_Err_Ok;
-    RasterPIC* container;
+    RasterPIC*        container;
-    FT_Memory memory = library->memory;
+    FT_Memory         memory        = library->memory;
+
 
     /* since this function also serve raster5 renderer, 
        it implements reference counting */
-    if(pic_container->raster)
+    if ( pic_container->raster )
     {
       ((RasterPIC*)pic_container->raster)->ref_count++;
       return error;

src/libs/freetype2/sfnt/sfdriver.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    High-level SFNT driver interface (body).                             */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -362,7 +362,7 @@
           *acharset_registry = registry.u.atom;
         }
         else
-          error = FT_Err_Invalid_Argument;
+          error = SFNT_Err_Invalid_Argument;
       }
     }
 
@@ -436,7 +436,7 @@
     FT_UNUSED( face_index );
     FT_UNUSED( header );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -449,7 +449,7 @@
     FT_UNUSED( stream );
     FT_UNUSED( header );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -460,7 +460,7 @@
     FT_UNUSED( face );
     FT_UNUSED( stream );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -513,7 +513,7 @@
      *  is only there for some rogue clients which would want to call it
      *  directly (which doesn't make much sense).
      */
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -534,7 +534,7 @@
     FT_UNUSED( cmap );
     FT_UNUSED( input );
 
-    return FT_Err_Unimplemented_Feature;
+    return SFNT_Err_Unimplemented_Feature;
   }
 
 
@@ -545,7 +545,7 @@
     FT_UNUSED( face );
     FT_UNUSED( cmap );
 
-    return 0;
+    return SFNT_Err_Ok;
   }
 
 #endif /* FT_CONFIG_OPTION_OLD_INTERNALS */

src/libs/freetype2/sfnt/sfntpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for sfnt module.     */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -60,15 +60,16 @@
   FT_Error
   sfnt_module_class_pic_init(  FT_Library library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error = SFNT_Err_Ok;
-    sfntModulePIC* container;
+    sfntModulePIC*     container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )
       return error;
-    FT_MEM_SET( container, 0, sizeof(*container) );
+    FT_MEM_SET( container, 0, sizeof ( *container ) );
     pic_container->sfnt = container;
 
     /* initialize pointer table - this is how the module usually expects this data */

src/libs/freetype2/sfnt/sfobjs.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    SFNT object management (base).                                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -50,9 +50,9 @@
   tt_name_entry_ascii_from_utf16( TT_NameEntry  entry,
                                   FT_Memory     memory )
   {
-    FT_String*  string;
+    FT_String*  string = NULL;
     FT_UInt     len, code, n;
-    FT_Byte*    read = (FT_Byte*)entry->string;
+    FT_Byte*    read   = (FT_Byte*)entry->string;
     FT_Error    error;
 
 
@@ -81,9 +81,9 @@
   tt_name_entry_ascii_from_other( TT_NameEntry  entry,
                                   FT_Memory     memory )
   {
-    FT_String*  string;
+    FT_String*  string = NULL;
     FT_UInt     len, code, n;
-    FT_Byte*    read = (FT_Byte*)entry->string;
+    FT_Byte*    read   = (FT_Byte*)entry->string;
     FT_Error    error;
 
 
@@ -160,7 +160,7 @@
       /* According to the OpenType 1.3 specification, only Microsoft or  */
       /* Apple platform IDs might be used in the `name' table.  The      */
       /* `Unicode' platform is reserved for the `cmap' table, and the    */
-      /* `Iso' one is deprecated.                                        */
+      /* `ISO' one is deprecated.                                        */
       /*                                                                 */
       /* However, the Apple TrueType specification doesn't say the same  */
       /* thing and goes to suggest that all Unicode `name' table entries */

src/libs/freetype2/sfnt/ttbdf.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType and OpenType embedded BDF properties (body).                */
 /*                                                                         */
-/*  Copyright 2005, 2006 by                                                */
+/*  Copyright 2005, 2006, 2010 by                                          */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -74,7 +74,7 @@
          length < 8                             ||
          FT_FRAME_EXTRACT( length, bdf->table ) )
     {
-      error = FT_Err_Invalid_Table;
+      error = SFNT_Err_Invalid_Table;
       goto Exit;
     }
 
@@ -131,7 +131,7 @@
   BadTable:
     FT_FRAME_RELEASE( bdf->table );
     FT_ZERO( bdf );
-    error = FT_Err_Invalid_Table;
+    error = SFNT_Err_Invalid_Table;
     goto Exit;
   }
 
@@ -143,7 +143,7 @@
   {
     TT_BDF     bdf   = &face->bdf;
     FT_Size    size  = FT_FACE(face)->size;
-    FT_Error   error = 0;
+    FT_Error   error = SFNT_Err_Ok;
     FT_Byte*   p;
     FT_UInt    count;
     FT_Byte*   strike;
@@ -163,7 +163,7 @@
     p      = bdf->table + 8;
     strike = p + 4 * count;
 
-    error = FT_Err_Invalid_Argument;
+    error = SFNT_Err_Invalid_Argument;
 
     if ( size == NULL || property_name == NULL )
       goto Exit;
@@ -215,7 +215,7 @@
             {
               aprop->type   = BDF_PROPERTY_TYPE_ATOM;
               aprop->u.atom = (const char*)bdf->strings + value;
-              error         = 0;
+              error         = SFNT_Err_Ok;
               goto Exit;
             }
             break;
@@ -223,13 +223,13 @@
           case 0x02:
             aprop->type      = BDF_PROPERTY_TYPE_INTEGER;
             aprop->u.integer = (FT_Int32)value;
-            error            = 0;
+            error            = SFNT_Err_Ok;
             goto Exit;
 
           case 0x03:
             aprop->type       = BDF_PROPERTY_TYPE_CARDINAL;
             aprop->u.cardinal = value;
-            error             = 0;
+            error             = SFNT_Err_Ok;
             goto Exit;
 
           default:

src/libs/freetype2/sfnt/ttcmap.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType character mapping table (cmap) support (body).              */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by            */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -2689,7 +2689,7 @@
                     FT_Memory  memory )
   {
     FT_UInt32 old_max = cmap->max_results;
-    FT_Error  error   = 0;
+    FT_Error  error   = SFNT_Err_Ok;
 
 
     if ( num_results > cmap->max_results )
@@ -2787,7 +2787,8 @@
         }
 
         /* and the non-default table (these glyphs are specified here) */
-        if ( nondefOff != 0 ) {
+        if ( nondefOff != 0 )
+        {
           FT_Byte*  ndp         = table + nondefOff;
           FT_ULong  numMappings = TT_NEXT_ULONG( ndp );
           FT_ULong  i, lastUni = 0;
@@ -3375,7 +3376,7 @@
     clazz[i] = NULL;
 
     *output_class = clazz;
-    return FT_Err_Ok;
+    return SFNT_Err_Ok;
   }
 
 #endif /*FT_CONFIG_OPTION_PIC*/
@@ -3391,11 +3392,12 @@
     FT_Byte*           limit = table + face->cmap_size;
     FT_UInt volatile   num_cmaps;
     FT_Byte* volatile  p     = table;
-    FT_Library         library = FT_FACE_LIBRARY(face);
+    FT_Library         library = FT_FACE_LIBRARY( face );
-    FT_UNUSED(library);
+
+    FT_UNUSED( library );
 
 
-    if ( p + 4 > limit )
+    if ( !p || p + 4 > limit )
       return SFNT_Err_Invalid_Table;
 
     /* only recognize format 0 */
@@ -3409,6 +3411,12 @@
     }
 
     num_cmaps = TT_NEXT_USHORT( p );
+#ifdef FT_MAX_CHARMAP_CACHEABLE
+    if ( num_cmaps > FT_MAX_CHARMAP_CACHEABLE )
+      FT_ERROR(( "tt_face_build_cmaps: too many cmap subtables(%d) "
+                 "subtable#%d and later are loaded but cannot be searched\n",
+                 num_cmaps, FT_MAX_CHARMAP_CACHEABLE + 1 ));
+#endif
 
     for ( ; num_cmaps > 0 && p + 8 <= limit; num_cmaps-- )
     {

src/libs/freetype2/sfnt/ttkern.c

@@ -5,7 +5,7 @@
 /*    Load the basic TrueType kerning table.  This doesn't handle          */
 /*    kerning data within the GPOS table at the moment.                    */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009 by       */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -115,7 +115,7 @@
       num_pairs = FT_NEXT_USHORT( p );
       p        += 6;
 
-      if ( ( p_next - p ) / 6 < (int)num_pairs ) /* handle broken count */
+      if ( ( p_next - p ) < 6 * (int)num_pairs ) /* handle broken count */
         num_pairs = (FT_UInt)( ( p_next - p ) / 6 );
 
       avail |= mask;
@@ -220,7 +220,7 @@
       num_pairs = FT_NEXT_USHORT( p );
       p        += 6;
 
-      if ( ( next - p ) / 6 < (int)num_pairs )  /* handle broken count  */
+      if ( ( next - p ) < 6 * (int)num_pairs )  /* handle broken count  */
         num_pairs = (FT_UInt)( ( next - p ) / 6 );
 
       switch ( coverage >> 8 )

src/libs/freetype2/sfnt/ttload.c

@@ -5,7 +5,8 @@
 /*    Load the basic TrueType tables, i.e., tables that can be either in   */
 /*    TTF or OTF fonts (body).                                             */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -77,7 +78,8 @@
     {
       /* For compatibility with Windows, we consider    */
       /* zero-length tables the same as missing tables. */
-      if ( entry->Tag == tag ) {
+      if ( entry->Tag == tag )
+      {
         if ( entry->Length != 0 )
         {
           FT_TRACE4(( "found table.\n" ));
@@ -693,6 +695,15 @@
 
         maxProfile->maxTwilightPoints = 0xFFFFU - 4;
       }
+
+      /* we arbitrarily limit recursion to avoid stack exhaustion */
+      if ( maxProfile->maxComponentDepth > 100 )
+      {
+        FT_TRACE0(( "tt_face_load_maxp:"
+                    " abnormally large component depth (%d) set to 100\n",
+                    maxProfile->maxComponentDepth ));
+        maxProfile->maxComponentDepth = 100;
+      }
     }
 
     FT_TRACE3(( "numGlyphs: %u\n", maxProfile->numGlyphs ));

src/libs/freetype2/sfnt/ttsbit.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    TrueType and OpenType embedded bitmap support (body).                */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -417,7 +418,7 @@
   tt_face_load_eblc( TT_Face    face,
                      FT_Stream  stream )
   {
-    FT_Error   error  = 0;
+    FT_Error   error  = SFNT_Err_Ok;
     FT_Memory  memory = stream->memory;
     FT_Fixed   version;
     FT_ULong   num_strikes;

src/libs/freetype2/smooth/ftgrays.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    A new `perfect' anti-aliasing renderer (body).                       */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2005, 2006, 2007, 2008, 2009 by       */
+/*  Copyright 2000-2001, 2002, 2003, 2005, 2006, 2007, 2008, 2009, 2010 by */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -103,10 +103,12 @@
 #include <stdarg.h>
 #endif
 
+#include <stddef.h>
 #include <string.h>
 #include <setjmp.h>
 #include <limits.h>
 #define FT_UINT_MAX  UINT_MAX
+#define FT_INT_MAX   INT_MAX
 
 #define ft_memset   memset
 
@@ -114,6 +116,8 @@
 #define ft_longjmp  longjmp
 #define ft_jmp_buf  jmp_buf
 
+typedef ptrdiff_t  FT_PtrDist;
+
 
 #define ErrRaster_Invalid_Mode      -2
 #define ErrRaster_Invalid_Outline   -1
@@ -1007,56 +1011,53 @@
                               const FT_Vector*  control2,
                               const FT_Vector*  to )
   {
-    TPos        dx, dy, da, db;
     int         top, level;
     int*        levels;
     FT_Vector*  arc;
+    int         mid_x = ( DOWNSCALE( ras.x ) + to->x +
+                          3 * (control1->x + control2->x ) ) / 8;
+    int         mid_y = ( DOWNSCALE( ras.y ) + to->y +
+                          3 * (control1->y + control2->y ) ) / 8;
+    TPos        dx = DOWNSCALE( ras.x ) + to->x - ( mid_x << 1 );
+    TPos        dy = DOWNSCALE( ras.y ) + to->y - ( mid_y << 1 );
 
 
-    dx = DOWNSCALE( ras.x ) + to->x - ( control1->x << 1 );
     if ( dx < 0 )
       dx = -dx;
-    dy = DOWNSCALE( ras.y ) + to->y - ( control1->y << 1 );
     if ( dy < 0 )
       dy = -dy;
     if ( dx < dy )
       dx = dy;
-    da = dx;
-
-    dx = DOWNSCALE( ras.x ) + to->x - 3 * ( control1->x + control2->x );
-    if ( dx < 0 )
-      dx = -dx;
-    dy = DOWNSCALE( ras.y ) + to->y - 3 * ( control1->x + control2->y );
-    if ( dy < 0 )
-      dy = -dy;
-    if ( dx < dy )
-      dx = dy;
-    db = dx;
 
     level = 1;
-    da    = da / ras.cubic_level;
+    dx /= ras.cubic_level;
-    db    = db / ras.conic_level;
+    while ( dx > 0 )
-    while ( da > 0 || db > 0 )
     {
-      da >>= 2;
+      dx >>= 2;
-      db >>= 3;
       level++;
     }
 
     if ( level <= 1 )
     {
-      TPos   to_x, to_y, mid_x, mid_y;
+      TPos  to_x, to_y;
 
 
       to_x  = UPSCALE( to->x );
       to_y  = UPSCALE( to->y );
+
+      /* Recalculation of midpoint is needed only if */
+      /* UPSCALE and DOWNSCALE have any effect.      */
+
+#if ( PIXEL_BITS != 6 )
       mid_x = ( ras.x + to_x +
                 3 * UPSCALE( control1->x + control2->x ) ) / 8;
       mid_y = ( ras.y + to_y +
                 3 * UPSCALE( control1->y + control2->y ) ) / 8;
+#endif
 
       gray_render_line( RAS_VAR_ mid_x, mid_y );
       gray_render_line( RAS_VAR_ to_x, to_y );
+
       return;
     }
 
@@ -1104,7 +1105,7 @@
 
     Draw:
       {
-        TPos  to_x, to_y, mid_x, mid_y;
+        TPos  to_x, to_y;
 
 
         to_x  = arc[0].x;
@@ -1189,7 +1190,7 @@
     /* first of all, compute the scanline offset */
     p = (unsigned char*)map->buffer - y * map->pitch;
     if ( map->pitch >= 0 )
-      p += ( map->rows - 1 ) * map->pitch;
+      p += (unsigned)( ( map->rows - 1 ) * map->pitch );
 
     for ( ; count > 0; count--, spans++ )
     {
@@ -2003,14 +2004,14 @@
     FT_UNUSED( raster );
   }
 
-#else /* _STANDALONE_ */
+#else /* !_STANDALONE_ */
 
   static int
   gray_raster_new( FT_Memory   memory,
                    FT_Raster*  araster )
   {
     FT_Error  error;
-    PRaster   raster;
+    PRaster   raster = NULL;
 
 
     *araster = 0;
@@ -2033,7 +2034,7 @@
     FT_FREE( raster );
   }
 
-#endif /* _STANDALONE_ */
+#endif /* !_STANDALONE_ */
 
 
   static void

src/libs/freetype2/smooth/ftsmooth.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Anti-aliasing renderer interface (body).                             */
 /*                                                                         */
-/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2009 by             */
+/*  Copyright 2000-2001, 2002, 2003, 2004, 2005, 2006, 2009, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -200,7 +200,7 @@
 
     /* Required check is ( pitch * height < FT_ULONG_MAX ),     */
     /* but we care realistic cases only. Always pitch <= width. */
-    if ( width > 0xFFFFU || height > 0xFFFFU )
+    if ( width > 0x7FFFU || height > 0x7FFFU )
     {
       FT_ERROR(( "ft_smooth_render_generic: glyph too large: %d x %d\n",
                  width, height ));

src/libs/freetype2/smooth/ftspic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for smooth module.   */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -43,12 +43,13 @@
 
 
   FT_Error
-  ft_smooth_renderer_class_pic_init(  FT_Library library )
+  ft_smooth_renderer_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = Smooth_Err_Ok;
-    SmoothPIC* container;
+    SmoothPIC*         container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* since this function also serve smooth_lcd and smooth_lcdv renderers, 
        it implements reference counting */

src/libs/freetype2/truetype/ttgload.c

@@ -161,8 +161,31 @@
                      &top_bearing,
                      &advance_height );
 
+    loader->left_bearing = left_bearing;
+    loader->advance      = advance_width;
+    loader->top_bearing  = top_bearing;
+    loader->vadvance     = advance_height;
+
+    if ( !loader->linear_def )
+    {
+      loader->linear_def = 1;
+      loader->linear     = advance_width;
+    }
+  }
+
+
 #ifdef FT_CONFIG_OPTION_INCREMENTAL
 
+  static void
+  tt_get_metrics_incr_overrides( TT_Loader  loader,
+                                 FT_UInt    glyph_index )
+  {
+    TT_Face  face = (TT_Face)loader->face;
+
+    FT_Short   left_bearing = 0, top_bearing = 0;
+    FT_UShort  advance_width = 0, advance_height = 0;
+
+
     /* If this is an incrementally loaded font check whether there are */
     /* overriding metrics for this glyph.                              */
     if ( face->root.internal->incremental_interface                           &&
@@ -172,9 +195,9 @@
       FT_Error                   error;
 
 
-      metrics.bearing_x = left_bearing;
+      metrics.bearing_x = loader->left_bearing;
       metrics.bearing_y = 0;
-      metrics.advance   = advance_width;
+      metrics.advance   = loader->advance;
       metrics.advance_v = 0;
 
       error = face->root.internal->incremental_interface->funcs->get_glyph_metrics(
@@ -190,8 +213,8 @@
 
       /* GWW: Do I do the same for vertical metrics? */
       metrics.bearing_x = 0;
-      metrics.bearing_y = top_bearing;
+      metrics.bearing_y = loader->top_bearing;
-      metrics.advance   = advance_height;
+      metrics.advance   = loader->vadvance;
 
       error = face->root.internal->incremental_interface->funcs->get_glyph_metrics(
                 face->root.internal->incremental_interface->object,
@@ -204,24 +227,24 @@
 
 #endif /* 0 */
 
+      loader->left_bearing = left_bearing;
+      loader->advance      = advance_width;
+      loader->top_bearing  = top_bearing;
+      loader->vadvance     = advance_height;
+
+      if ( !loader->linear_def )
+      {
+        loader->linear_def = 1;
+        loader->linear     = advance_width;
+      }
     }
 
   Exit:
+    return;
+  }
 
 #endif /* FT_CONFIG_OPTION_INCREMENTAL */
 
-    loader->left_bearing = left_bearing;
-    loader->advance      = advance_width;
-    loader->top_bearing  = top_bearing;
-    loader->vadvance     = advance_height;
-
-    if ( !loader->linear_def )
-    {
-      loader->linear_def = 1;
-      loader->linear     = advance_width;
-    }
-  }
-
 
   /*************************************************************************/
   /*                                                                       */
@@ -271,7 +294,7 @@
     FT_UNUSED( glyph_index );
 
 
-    FT_TRACE5(( "Glyph %ld\n", glyph_index ));
+    FT_TRACE4(( "Glyph %ld\n", glyph_index ));
 
     /* the following line sets the `error' variable through macros! */
     if ( FT_STREAM_SEEK( offset ) || FT_FRAME_ENTER( byte_count ) )
@@ -367,7 +390,7 @@
       if ( cont[0] <= prev_cont )
       {
         /* unordered contours: this is invalid */
-        error = FT_Err_Invalid_Table;
+        error = TT_Err_Invalid_Table;
         goto Fail;
       }
       prev_cont = cont[0];
@@ -1118,7 +1141,8 @@
 
     {
       FT_Stream  stream = loader->stream;
-      FT_UShort  n_ins;
+      FT_UShort  n_ins, max_ins;
+      FT_ULong   tmp;
 
 
       /* TT_Load_Composite_Glyph only gives us the offset of instructions */
@@ -1130,12 +1154,27 @@
       FT_TRACE5(( "  Instructions size = %d\n", n_ins ));
 
       /* check it */
-      if ( n_ins > ((TT_Face)loader->face)->max_profile.maxSizeOfInstructions )
+      max_ins = ((TT_Face)loader->face)->max_profile.maxSizeOfInstructions;
+      if ( n_ins > max_ins )
       {
-        FT_TRACE0(( "TT_Process_Composite_Glyph: too many instructions (%d)\n",
+        /* acroread ignores this field, so we only do a rough safety check */
-                    n_ins ));
+        if ( (FT_Int)n_ins > loader->byte_len )
+        {
+          FT_TRACE1(( "TT_Process_Composite_Glyph: "
+                      "too many instructions (%d) for glyph with length %d\n",
+                      n_ins, loader->byte_len ));
+          return TT_Err_Too_Many_Hints;
+        }
 
-        return TT_Err_Too_Many_Hints;
+        tmp = loader->exec->glyphSize;
+        error = Update_Max( loader->exec->memory,
+                            &tmp,
+                            sizeof ( FT_Byte ),
+                            (void*)&loader->exec->glyphIns,
+                            n_ins );
+        loader->exec->glyphSize = (FT_UShort)tmp;
+        if ( error )
+          return error;
       }
       else if ( n_ins == 0 )
         return TT_Err_Ok;
@@ -1316,8 +1355,14 @@
       if ( header_only )
         goto Exit;
 
+      /* must initialize points before (possibly) overriding */
+      /* glyph metrics from the incremental interface        */
       TT_LOADER_SET_PP( loader );
 
+#ifdef FT_CONFIG_OPTION_INCREMENTAL
+      tt_get_metrics_incr_overrides( loader, glyph_index );
+#endif
+
 #ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
 
       if ( ((TT_Face)(loader->face))->doblend )
@@ -1353,8 +1398,14 @@
       goto Exit;
     }
 
+    /* must initialize points before (possibly) overriding */
+    /* glyph metrics from the incremental interface        */
     TT_LOADER_SET_PP( loader );
 
+#ifdef FT_CONFIG_OPTION_INCREMENTAL
+    tt_get_metrics_incr_overrides( loader, glyph_index );
+#endif
+
     /***********************************************************************/
     /***********************************************************************/
     /***********************************************************************/
@@ -1481,6 +1532,7 @@
         FT_UInt      num_base_subgs = gloader->base.num_subglyphs;
 
         FT_Stream    old_stream     = loader->stream;
+        FT_Int       old_byte_len   = loader->byte_len;
 
 
         FT_GlyphLoader_Add( gloader );
@@ -1535,7 +1587,8 @@
                                           num_base_points );
         }
 
-        loader->stream = old_stream;
+        loader->stream   = old_stream;
+        loader->byte_len = old_byte_len;
 
         /* process the glyph */
         loader->ins_pos = ins_pos;
@@ -2031,9 +2084,11 @@
         glyph->outline        = loader.gloader->base.outline;
         glyph->outline.flags &= ~FT_OUTLINE_SINGLE_PASS;
 
-        /* In case bit 1 of the `flags' field in the `head' table isn't */
+        /* Translate array so that (0,0) is the glyph's origin.  Note  */
-        /* set, translate array so that (0,0) is the glyph's origin.    */
+        /* that this behaviour is independent on the value of bit 1 of */
-        if ( ( face->header.Flags & 2 ) == 0 && loader.pp1.x )
+        /* the `flags' field in the `head' table -- at least major     */
+        /* applications like Acroread indicate that.                   */
+        if ( loader.pp1.x )
           FT_Outline_Translate( &glyph->outline, -loader.pp1.x, 0 );
       }
 

src/libs/freetype2/truetype/ttgxvar.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType GX Font Variation loader                                    */
 /*                                                                         */
-/*  Copyright 2004, 2005, 2006, 2007, 2008, 2009 by                        */
+/*  Copyright 2004, 2005, 2006, 2007, 2008, 2009, 2010 by                  */
 /*  David Turner, Robert Wilhelm, Werner Lemberg, and George Williams.     */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -210,12 +210,12 @@
   ft_var_readpackeddeltas( FT_Stream  stream,
                            FT_Offset  delta_cnt )
   {
-    FT_Short  *deltas;
+    FT_Short  *deltas = NULL;
     FT_UInt    runcnt;
     FT_Offset  i;
     FT_UInt    j;
     FT_Memory  memory = stream->memory;
-    FT_Error   error = TT_Err_Ok;
+    FT_Error   error  = TT_Err_Ok;
 
     FT_UNUSED( error );
 
@@ -682,7 +682,11 @@
       if ( fvar_head.version != (FT_Long)0x00010000L                      ||
            fvar_head.countSizePairs != 2                                  ||
            fvar_head.axisSize != 20                                       ||
+           /* axisCount limit implied by 16-bit instanceSize */
+           fvar_head.axisCount > 0x3FFE                                   ||
            fvar_head.instanceSize != 4 + 4 * fvar_head.axisCount          ||
+           /* instanceCount limit implied by limited range of name IDs */
+           fvar_head.instanceCount > 0x7EFF                               ||
            fvar_head.offsetToData + fvar_head.axisCount * 20U +
              fvar_head.instanceCount * fvar_head.instanceSize > table_len )
       {
@@ -693,7 +697,7 @@
       if ( FT_NEW( face->blend ) )
         goto Exit;
 
-      /* XXX: TODO - check for overflows */
+      /* cannot overflow 32-bit arithmetic because of limits above */
       face->blend->mmvar_len =
         sizeof ( FT_MM_Var ) +
         fvar_head.axisCount * sizeof ( FT_Var_Axis ) +

src/libs/freetype2/truetype/ttinterp.c

@@ -4,8 +4,9 @@
 /*                                                                         */
 /*    TrueType bytecode interpreter (body).                                */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
-/*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
+/*            2010                                                         */
+/*  by David Turner, Robert Wilhelm, and Werner Lemberg.                   */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
 /*  modified, and distributed under the terms of the FreeType project      */
@@ -223,9 +224,10 @@
 
   /*************************************************************************/
   /*                                                                       */
-  /* A simple bounds-checking macro.                                       */
+  /* Two simple bounds-checking macros.                                    */
   /*                                                                       */
-#define BOUNDS( x, n )  ( (FT_UInt)(x) >= (FT_UInt)(n) )
+#define BOUNDS( x, n )   ( (FT_UInt)(x)  >= (FT_UInt)(n)  )
+#define BOUNDSL( x, n )  ( (FT_ULong)(x) >= (FT_ULong)(n) )
 
 #undef  SUCCESS
 #define SUCCESS  0
@@ -508,7 +510,7 @@
   /* <Return>                                                              */
   /*    FreeType error code.  0 means success.                             */
   /*                                                                       */
-  static FT_Error
+  FT_LOCAL_DEF( FT_Error )
   Update_Max( FT_Memory  memory,
               FT_ULong*  size,
               FT_Long    multiplier,
@@ -1111,6 +1113,287 @@
   };
 
 
+#ifdef FT_DEBUG_LEVEL_TRACE
+
+  static
+  const char*  const opcode_name[256] =
+  {
+    "SVTCA y",
+    "SVTCA x",
+    "SPvTCA y",
+    "SPvTCA x",
+    "SFvTCA y",
+    "SFvTCA x",
+    "SPvTL ||",
+    "SPvTL +",
+    "SFvTL ||",
+    "SFvTL +",
+    "SPvFS",
+    "SFvFS",
+    "GPV",
+    "GFV",
+    "SFvTPv",
+    "ISECT",
+
+    "SRP0",
+    "SRP1",
+    "SRP2",
+    "SZP0",
+    "SZP1",
+    "SZP2",
+    "SZPS",
+    "SLOOP",
+    "RTG",
+    "RTHG",
+    "SMD",
+    "ELSE",
+    "JMPR",
+    "SCvTCi",
+    "SSwCi",
+    "SSW",
+
+    "DUP",
+    "POP",
+    "CLEAR",
+    "SWAP",
+    "DEPTH",
+    "CINDEX",
+    "MINDEX",
+    "AlignPTS",
+    "INS_$28",
+    "UTP",
+    "LOOPCALL",
+    "CALL",
+    "FDEF",
+    "ENDF",
+    "MDAP[0]",
+    "MDAP[1]",
+
+    "IUP[0]",
+    "IUP[1]",
+    "SHP[0]",
+    "SHP[1]",
+    "SHC[0]",
+    "SHC[1]",
+    "SHZ[0]",
+    "SHZ[1]",
+    "SHPIX",
+    "IP",
+    "MSIRP[0]",
+    "MSIRP[1]",
+    "AlignRP",
+    "RTDG",
+    "MIAP[0]",
+    "MIAP[1]",
+
+    "NPushB",
+    "NPushW",
+    "WS",
+    "RS",
+    "WCvtP",
+    "RCvt",
+    "GC[0]",
+    "GC[1]",
+    "SCFS",
+    "MD[0]",
+    "MD[1]",
+    "MPPEM",
+    "MPS",
+    "FlipON",
+    "FlipOFF",
+    "DEBUG",
+
+    "LT",
+    "LTEQ",
+    "GT",
+    "GTEQ",
+    "EQ",
+    "NEQ",
+    "ODD",
+    "EVEN",
+    "IF",
+    "EIF",
+    "AND",
+    "OR",
+    "NOT",
+    "DeltaP1",
+    "SDB",
+    "SDS",
+
+    "ADD",
+    "SUB",
+    "DIV",
+    "MUL",
+    "ABS",
+    "NEG",
+    "FLOOR",
+    "CEILING",
+    "ROUND[0]",
+    "ROUND[1]",
+    "ROUND[2]",
+    "ROUND[3]",
+    "NROUND[0]",
+    "NROUND[1]",
+    "NROUND[2]",
+    "NROUND[3]",
+
+    "WCvtF",
+    "DeltaP2",
+    "DeltaP3",
+    "DeltaCn[0]",
+    "DeltaCn[1]",
+    "DeltaCn[2]",
+    "SROUND",
+    "S45Round",
+    "JROT",
+    "JROF",
+    "ROFF",
+    "INS_$7B",
+    "RUTG",
+    "RDTG",
+    "SANGW",
+    "AA",
+
+    "FlipPT",
+    "FlipRgON",
+    "FlipRgOFF",
+    "INS_$83",
+    "INS_$84",
+    "ScanCTRL",
+    "SDVPTL[0]",
+    "SDVPTL[1]",
+    "GetINFO",
+    "IDEF",
+    "ROLL",
+    "MAX",
+    "MIN",
+    "ScanTYPE",
+    "InstCTRL",
+    "INS_$8F",
+
+    "INS_$90",
+    "INS_$91",
+    "INS_$92",
+    "INS_$93",
+    "INS_$94",
+    "INS_$95",
+    "INS_$96",
+    "INS_$97",
+    "INS_$98",
+    "INS_$99",
+    "INS_$9A",
+    "INS_$9B",
+    "INS_$9C",
+    "INS_$9D",
+    "INS_$9E",
+    "INS_$9F",
+
+    "INS_$A0",
+    "INS_$A1",
+    "INS_$A2",
+    "INS_$A3",
+    "INS_$A4",
+    "INS_$A5",
+    "INS_$A6",
+    "INS_$A7",
+    "INS_$A8",
+    "INS_$A9",
+    "INS_$AA",
+    "INS_$AB",
+    "INS_$AC",
+    "INS_$AD",
+    "INS_$AE",
+    "INS_$AF",
+
+    "PushB[0]",
+    "PushB[1]",
+    "PushB[2]",
+    "PushB[3]",
+    "PushB[4]",
+    "PushB[5]",
+    "PushB[6]",
+    "PushB[7]",
+    "PushW[0]",
+    "PushW[1]",
+    "PushW[2]",
+    "PushW[3]",
+    "PushW[4]",
+    "PushW[5]",
+    "PushW[6]",
+    "PushW[7]",
+
+    "MDRP[00]",
+    "MDRP[01]",
+    "MDRP[02]",
+    "MDRP[03]",
+    "MDRP[04]",
+    "MDRP[05]",
+    "MDRP[06]",
+    "MDRP[07]",
+    "MDRP[08]",
+    "MDRP[09]",
+    "MDRP[10]",
+    "MDRP[11]",
+    "MDRP[12]",
+    "MDRP[13]",
+    "MDRP[14]",
+    "MDRP[15]",
+
+    "MDRP[16]",
+    "MDRP[17]",
+    "MDRP[18]",
+    "MDRP[19]",
+    "MDRP[20]",
+    "MDRP[21]",
+    "MDRP[22]",
+    "MDRP[23]",
+    "MDRP[24]",
+    "MDRP[25]",
+    "MDRP[26]",
+    "MDRP[27]",
+    "MDRP[28]",
+    "MDRP[29]",
+    "MDRP[30]",
+    "MDRP[31]",
+
+    "MIRP[00]",
+    "MIRP[01]",
+    "MIRP[02]",
+    "MIRP[03]",
+    "MIRP[04]",
+    "MIRP[05]",
+    "MIRP[06]",
+    "MIRP[07]",
+    "MIRP[08]",
+    "MIRP[09]",
+    "MIRP[10]",
+    "MIRP[11]",
+    "MIRP[12]",
+    "MIRP[13]",
+    "MIRP[14]",
+    "MIRP[15]",
+
+    "MIRP[16]",
+    "MIRP[17]",
+    "MIRP[18]",
+    "MIRP[19]",
+    "MIRP[20]",
+    "MIRP[21]",
+    "MIRP[22]",
+    "MIRP[23]",
+    "MIRP[24]",
+    "MIRP[25]",
+    "MIRP[26]",
+    "MIRP[27]",
+    "MIRP[28]",
+    "MIRP[29]",
+    "MIRP[30]",
+    "MIRP[31]"
+  };
+
+#endif /* FT_DEBUG_LEVEL_TRACE */
+
+
   static
   const FT_Char  opcode_length[256] =
   {
@@ -1727,7 +2010,8 @@
       if ( distance && val < 0 )
         val = 0;
     }
-    else {
+    else
+    {
       val = distance - compensation;
       if ( val > 0 )
         val = 0;
@@ -2892,24 +3176,30 @@
   }
 
 
-#define DO_JROT               \
+#define DO_JROT                          \
-    if ( args[1] != 0 )       \
+    if ( args[1] != 0 )                  \
-    {                         \
+    {                                    \
-      CUR.IP      += args[0]; \
+      CUR.IP      += args[0];            \
-      CUR.step_ins = FALSE;   \
+      if ( CUR.IP < 0 )                  \
+        CUR.error = TT_Err_Bad_Argument; \
+      CUR.step_ins = FALSE;              \
     }
 
 
-#define DO_JMPR             \
+#define DO_JMPR                        \
-    CUR.IP      += args[0]; \
+    CUR.IP      += args[0];            \
+    if ( CUR.IP < 0 )                  \
+      CUR.error = TT_Err_Bad_Argument; \
     CUR.step_ins = FALSE;
 
 
-#define DO_JROF               \
+#define DO_JROF                          \
-    if ( args[1] == 0 )       \
+    if ( args[1] == 0 )                  \
-    {                         \
+    {                                    \
-      CUR.IP      += args[0]; \
+      CUR.IP      += args[0];            \
-      CUR.step_ins = FALSE;   \
+      if ( CUR.IP < 0 )                  \
+        CUR.error = TT_Err_Bad_Argument; \
+      CUR.step_ins = FALSE;              \
     }
 
 
@@ -2992,39 +3282,39 @@
     args[0] = FT_PIX_CEIL( args[0] );
 
 
-#define DO_RS                          \
+#define DO_RS                           \
-   {                                   \
+   {                                    \
-     FT_ULong  I = (FT_ULong)args[0];  \
+     FT_ULong  I = (FT_ULong)args[0];   \
-                                       \
+                                        \
-                                       \
+                                        \
-     if ( BOUNDS( I, CUR.storeSize ) ) \
+     if ( BOUNDSL( I, CUR.storeSize ) ) \
-     {                                 \
+     {                                  \
-       if ( CUR.pedantic_hinting )     \
+       if ( CUR.pedantic_hinting )      \
-       {                               \
+       {                                \
-         ARRAY_BOUND_ERROR;            \
+         ARRAY_BOUND_ERROR;             \
-       }                               \
+       }                                \
-       else                            \
+       else                             \
-         args[0] = 0;                  \
+         args[0] = 0;                   \
-     }                                 \
+     }                                  \
-     else                              \
+     else                               \
-       args[0] = CUR.storage[I];       \
+       args[0] = CUR.storage[I];        \
    }
 
 
-#define DO_WS                          \
+#define DO_WS                           \
-   {                                   \
+   {                                    \
-     FT_ULong  I = (FT_ULong)args[0];  \
+     FT_ULong  I = (FT_ULong)args[0];   \
-                                       \
+                                        \
-                                       \
+                                        \
-     if ( BOUNDS( I, CUR.storeSize ) ) \
+     if ( BOUNDSL( I, CUR.storeSize ) ) \
-     {                                 \
+     {                                  \
-       if ( CUR.pedantic_hinting )     \
+       if ( CUR.pedantic_hinting )      \
-       {                               \
+       {                                \
-         ARRAY_BOUND_ERROR;            \
+         ARRAY_BOUND_ERROR;             \
-       }                               \
+       }                                \
-     }                                 \
+     }                                  \
-     else                              \
+     else                               \
-       CUR.storage[I] = args[1];       \
+       CUR.storage[I] = args[1];        \
    }
 
 
@@ -3033,7 +3323,7 @@
      FT_ULong  I = (FT_ULong)args[0];    \
                                          \
                                          \
-     if ( BOUNDS( I, CUR.cvtSize ) )     \
+     if ( BOUNDSL( I, CUR.cvtSize ) )    \
      {                                   \
        if ( CUR.pedantic_hinting )       \
        {                                 \
@@ -3052,7 +3342,7 @@
      FT_ULong  I = (FT_ULong)args[0];    \
                                          \
                                          \
-     if ( BOUNDS( I, CUR.cvtSize ) )     \
+     if ( BOUNDSL( I, CUR.cvtSize ) )    \
      {                                   \
        if ( CUR.pedantic_hinting )       \
        {                                 \
@@ -3069,7 +3359,7 @@
      FT_ULong  I = (FT_ULong)args[0];                           \
                                                                 \
                                                                 \
-     if ( BOUNDS( I, CUR.cvtSize ) )                            \
+     if ( BOUNDSL( I, CUR.cvtSize ) )                           \
      {                                                          \
        if ( CUR.pedantic_hinting )                              \
        {                                                        \
@@ -4390,7 +4680,7 @@
     /* first of all, check the index */
 
     F = args[0];
-    if ( BOUNDS( F, CUR.maxFunc + 1 ) )
+    if ( BOUNDSL( F, CUR.maxFunc + 1 ) )
       goto Fail;
 
     /* Except for some old Apple fonts, all functions in a TrueType */
@@ -4466,7 +4756,7 @@
 
     /* first of all, check the index */
     F = args[1];
-    if ( BOUNDS( F, CUR.maxFunc + 1 ) )
+    if ( BOUNDSL( F, CUR.maxFunc + 1 ) )
       goto Fail;
 
     /* Except for some old Apple fonts, all functions in a TrueType */
@@ -4569,7 +4859,7 @@
     }
 
     def->opc    = (FT_Byte)args[0];
-    def->start  = CUR.IP+1;
+    def->start  = CUR.IP + 1;
     def->range  = CUR.curRange;
     def->active = TRUE;
 
@@ -4741,7 +5031,7 @@
 
     L = (FT_ULong)args[0];
 
-    if ( BOUNDS( L, CUR.zp2.n_points ) )
+    if ( BOUNDSL( L, CUR.zp2.n_points ) )
     {
       if ( CUR.pedantic_hinting )
       {
@@ -4825,8 +5115,8 @@
     K = (FT_UShort)args[1];
     L = (FT_UShort)args[0];
 
-    if( BOUNDS( L, CUR.zp0.n_points ) ||
+    if ( BOUNDS( L, CUR.zp0.n_points ) ||
-        BOUNDS( K, CUR.zp1.n_points ) )
+         BOUNDS( K, CUR.zp1.n_points ) )
     {
       if ( CUR.pedantic_hinting )
       {
@@ -5480,12 +5770,12 @@
   static void
   Ins_SHZ( INS_ARG )
   {
-    TT_GlyphZoneRec zp;
+    TT_GlyphZoneRec  zp;
-    FT_UShort       refp;
+    FT_UShort        refp;
-    FT_F26Dot6      dx,
+    FT_F26Dot6       dx,
-                    dy;
+                     dy;
 
-    FT_UShort       last_point, i;
+    FT_UShort        last_point, i;
 
 
     if ( BOUNDS( args[0], 2 ) )
@@ -5687,8 +5977,8 @@
     cvtEntry = (FT_ULong)args[1];
     point    = (FT_UShort)args[0];
 
-    if ( BOUNDS( point,    CUR.zp0.n_points ) ||
+    if ( BOUNDS( point,     CUR.zp0.n_points ) ||
-         BOUNDS( cvtEntry, CUR.cvtSize )      )
+         BOUNDSL( cvtEntry, CUR.cvtSize )      )
     {
       if ( CUR.pedantic_hinting )
         CUR.error = TT_Err_Invalid_Reference;
@@ -5880,7 +6170,7 @@
     /* XXX: UNDOCUMENTED! cvt[-1] = 0 always */
 
     if ( BOUNDS( point,      CUR.zp1.n_points ) ||
-         BOUNDS( cvtEntry,   CUR.cvtSize + 1 )  ||
+         BOUNDSL( cvtEntry,  CUR.cvtSize + 1 )  ||
          BOUNDS( CUR.GS.rp0, CUR.zp0.n_points ) )
     {
       if ( CUR.pedantic_hinting )
@@ -6131,8 +6421,8 @@
     p1 = (FT_UShort)args[0];
     p2 = (FT_UShort)args[1];
 
-    if ( BOUNDS( args[0], CUR.zp1.n_points ) ||
+    if ( BOUNDS( p1, CUR.zp1.n_points ) ||
-         BOUNDS( args[1], CUR.zp0.n_points ) )
+         BOUNDS( p2, CUR.zp0.n_points ) )
     {
       if ( CUR.pedantic_hinting )
         CUR.error = TT_Err_Invalid_Reference;
@@ -6466,8 +6756,8 @@
       end_point   = CUR.pts.contours[contour] - CUR.pts.first_point;
       first_point = point;
 
-      if ( CUR.pts.n_points <= end_point )
+      if ( BOUNDS ( end_point, CUR.pts.n_points ) )
-        end_point = CUR.pts.n_points;
+        end_point = CUR.pts.n_points - 1;
 
       while ( point <= end_point && ( CUR.pts.tags[point] & mask ) == 0 )
         point++;
@@ -6661,7 +6951,7 @@
       A = (FT_ULong)CUR.stack[CUR.args + 1];
       B = CUR.stack[CUR.args];
 
-      if ( BOUNDS( A, CUR.cvtSize ) )
+      if ( BOUNDSL( A, CUR.cvtSize ) )
       {
         if ( CUR.pedantic_hinting )
         {
@@ -6771,7 +7061,7 @@
         call = CUR.callStack + CUR.callTop++;
 
         call->Caller_Range = CUR.curRange;
-        call->Caller_IP    = CUR.IP+1;
+        call->Caller_IP    = CUR.IP + 1;
         call->Cur_Count    = 1;
         call->Cur_Restart  = def->start;
 
@@ -7140,6 +7430,10 @@
     {
       CUR.opcode = CUR.code[CUR.IP];
 
+      FT_TRACE7(( "  " ));
+      FT_TRACE7(( opcode_name[CUR.opcode] ));
+      FT_TRACE7(( "\n" ));
+
       if ( ( CUR.length = opcode_length[CUR.opcode] ) < 0 )
       {
         if ( CUR.IP + 1 > CUR.codeSize )

src/libs/freetype2/truetype/ttinterp.h

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    TrueType bytecode interpreter (specification).                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007 by             */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2010 by       */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -150,7 +150,7 @@ FT_BEGIN_HEADER
 
     FT_Bool            step_ins;  /* true if the interpreter must */
                                   /* increment IP after ins. exec */
-    FT_Long            cvtSize;
+    FT_ULong           cvtSize;
     FT_Long*           cvt;
 
     FT_UInt            glyphSize; /* glyph instructions buffer size */
@@ -239,6 +239,14 @@ FT_BEGIN_HEADER
                       FT_Int          range );
 
 
+  FT_LOCAL( FT_Error )
+  Update_Max( FT_Memory  memory,
+              FT_ULong*  size,
+              FT_Long    multiplier,
+              void*      _pbuff,
+              FT_ULong   new_max );
+
+
   /*************************************************************************/
   /*                                                                       */
   /* <Function>                                                            */

src/libs/freetype2/truetype/ttpic.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    The FreeType position independent code services for truetype module. */
 /*                                                                         */
-/*  Copyright 2009 by                                                      */
+/*  Copyright 2009, 2010 by                                                */
 /*  Oran Agra and Mickey Gabel.                                            */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -45,13 +45,15 @@
     }
   }
 
+
   FT_Error
-  tt_driver_class_pic_init(  FT_Library library )
+  tt_driver_class_pic_init( FT_Library  library )
   {
-    FT_PIC_Container* pic_container = &library->pic_container;
+    FT_PIC_Container*  pic_container = &library->pic_container;
-    FT_Error        error = FT_Err_Ok;
+    FT_Error           error         = TT_Err_Ok;
-    TTModulePIC* container;
+    TTModulePIC*       container;
-    FT_Memory memory = library->memory;
+    FT_Memory          memory        = library->memory;
+
 
     /* allocate pointer, clear and set global container pointer */
     if ( FT_ALLOC ( container, sizeof ( *container ) ) )

src/libs/freetype2/type1/t1afm.c

@@ -4,7 +4,8 @@
 /*                                                                         */
 /*    AFM support for Type 1 fonts (body).                                 */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by */
+/*  Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,   */
+/*            2010 by                                                      */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -235,10 +236,10 @@
                    FT_Stream  stream )
   {
     PSAux_Service  psaux;
-    FT_Memory      memory = stream->memory;
+    FT_Memory      memory  = stream->memory;
     AFM_ParserRec  parser;
-    AFM_FontInfo   fi;
+    AFM_FontInfo   fi      = NULL;
-    FT_Error       error = T1_Err_Unknown_File_Format;
+    FT_Error       error   = T1_Err_Unknown_File_Format;
     T1_Font        t1_font = &( (T1_Face)t1_face )->type1;
 
 

src/libs/freetype2/type1/t1objs.c

@@ -494,14 +494,17 @@
         charmap.face = root;
 
         /* first of all, try to synthesize a Unicode charmap */
-        charmap.platform_id = 3;
+        charmap.platform_id = TT_PLATFORM_MICROSOFT;
-        charmap.encoding_id = 1;
+        charmap.encoding_id = TT_MS_ID_UNICODE_CS;
         charmap.encoding    = FT_ENCODING_UNICODE;
 
-        FT_CMap_New( cmap_classes->unicode, NULL, &charmap, NULL );
+        error = FT_CMap_New( cmap_classes->unicode, NULL, &charmap, NULL );
+        if ( error && FT_Err_No_Unicode_Glyph_Name != error )
+          goto Exit;
+        error = FT_Err_Ok;
 
         /* now, generate an Adobe Standard encoding when appropriate */
-        charmap.platform_id = 7;
+        charmap.platform_id = TT_PLATFORM_ADOBE;
         clazz               = NULL;
 
         switch ( type1->encoding_type )
@@ -535,7 +538,7 @@
         }
 
         if ( clazz )
-          FT_CMap_New( clazz, NULL, &charmap, NULL );
+          error = FT_CMap_New( clazz, NULL, &charmap, NULL );
 
 #if 0
         /* Select default charmap */

src/libs/freetype2/type42/t42objs.c

@@ -21,6 +21,7 @@
 #include "t42error.h"
 #include FT_INTERNAL_DEBUG_H
 #include FT_LIST_H
+#include FT_TRUETYPE_IDS_H 
 
 
 #undef  FT_COMPONENT
@@ -330,39 +331,42 @@
         charmap.face = root;
 
         /* first of all, try to synthesize a Unicode charmap */
-        charmap.platform_id = 3;
+        charmap.platform_id = TT_PLATFORM_MICROSOFT;
-        charmap.encoding_id = 1;
+        charmap.encoding_id = TT_MS_ID_UNICODE_CS;
         charmap.encoding    = FT_ENCODING_UNICODE;
 
-        FT_CMap_New( cmap_classes->unicode, NULL, &charmap, NULL );
+        error = FT_CMap_New( cmap_classes->unicode, NULL, &charmap, NULL );
+        if ( error && FT_Err_No_Unicode_Glyph_Name != error )
+          goto Exit;
+        error = FT_Err_Ok;
 
         /* now, generate an Adobe Standard encoding when appropriate */
-        charmap.platform_id = 7;
+        charmap.platform_id = TT_PLATFORM_ADOBE;
         clazz               = NULL;
 
         switch ( type1->encoding_type )
         {
         case T1_ENCODING_TYPE_STANDARD:
           charmap.encoding    = FT_ENCODING_ADOBE_STANDARD;
-          charmap.encoding_id = 0;
+          charmap.encoding_id = TT_ADOBE_ID_STANDARD;
           clazz               = cmap_classes->standard;
           break;
 
         case T1_ENCODING_TYPE_EXPERT:
           charmap.encoding    = FT_ENCODING_ADOBE_EXPERT;
-          charmap.encoding_id = 1;
+          charmap.encoding_id = TT_ADOBE_ID_EXPERT;
           clazz               = cmap_classes->expert;
           break;
 
         case T1_ENCODING_TYPE_ARRAY:
           charmap.encoding    = FT_ENCODING_ADOBE_CUSTOM;
-          charmap.encoding_id = 2;
+          charmap.encoding_id = TT_ADOBE_ID_CUSTOM;
           clazz               = cmap_classes->custom;
           break;
 
         case T1_ENCODING_TYPE_ISOLATIN1:
           charmap.encoding    = FT_ENCODING_ADOBE_LATIN_1;
-          charmap.encoding_id = 3;
+          charmap.encoding_id = TT_ADOBE_ID_LATIN_1;
           clazz               = cmap_classes->unicode;
           break;
 
@@ -371,7 +375,7 @@
         }
 
         if ( clazz )
-          FT_CMap_New( clazz, NULL, &charmap, NULL );
+          error = FT_CMap_New( clazz, NULL, &charmap, NULL );
 
 #if 0
         /* Select default charmap */

src/libs/freetype2/type42/t42parse.c

@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 42 font parser (body).                                          */
 /*                                                                         */
-/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 by            */
+/*  Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 by      */
 /*  Roberto Alameda.                                                       */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -52,7 +52,8 @@
   /* as Type42 fonts have no Private dict,         */
   /* we set the last argument of T1_FIELD_XXX to 0 */
   static const
-  T1_FieldRec  t42_keywords[] = {
+  T1_FieldRec  t42_keywords[] =
+  {
 
 #undef  FT_STRUCTURE
 #define FT_STRUCTURE  T1_FontInfo
@@ -268,7 +269,8 @@
                                                  temp_scale ) >> 16 );
 
     /* we need to scale the values by 1.0/temp_scale */
-    if ( temp_scale != 0x10000L ) {
+    if ( temp_scale != 0x10000L )
+    {
       temp[0] = FT_DivFix( temp[0], temp_scale );
       temp[1] = FT_DivFix( temp[1], temp_scale );
       temp[2] = FT_DivFix( temp[2], temp_scale );
@@ -575,6 +577,12 @@
         }
 
         string_size = T1_ToInt( parser );
+        if ( string_size < 0 )
+        {
+          FT_ERROR(( "t42_parse_sfnts: invalid string size\n" ));
+          error = T42_Err_Invalid_File_Format;
+          goto Fail;
+        }
 
         T1_Skip_PS_Token( parser );             /* `RD' */
         if ( parser->root.error )
@@ -582,13 +590,14 @@
 
         string_buf = parser->root.cursor + 1;   /* one space after `RD' */
 
-        parser->root.cursor += string_size + 1;
+        if ( limit - parser->root.cursor < string_size )
-        if ( parser->root.cursor >= limit )
         {
           FT_ERROR(( "t42_parse_sfnts: too many binary data\n" ));
           error = T42_Err_Invalid_File_Format;
           goto Fail;
         }
+        else
+          parser->root.cursor += string_size + 1;
       }
 
       if ( !string_buf )

src/libs/freetype2/winfonts/winfnt.c

@@ -23,6 +23,7 @@
 #include FT_INTERNAL_DEBUG_H
 #include FT_INTERNAL_STREAM_H
 #include FT_INTERNAL_OBJECTS_H
+#include FT_TRUETYPE_IDS_H 
 
 #include "winfnt.h"
 #include "fnterrs.h"
@@ -802,15 +803,16 @@
 
 
         charmap.encoding    = FT_ENCODING_NONE;
-        charmap.platform_id = 0;
+        /* initial platform/encoding should indicate unset status? */
-        charmap.encoding_id = 0;
+        charmap.platform_id = TT_PLATFORM_APPLE_UNICODE;
+        charmap.encoding_id = TT_APPLE_ID_DEFAULT;
         charmap.face        = root;
 
         if ( font->header.charset == FT_WinFNT_ID_MAC )
         {
           charmap.encoding    = FT_ENCODING_APPLE_ROMAN;
-          charmap.platform_id = 1;
+          charmap.platform_id = TT_PLATFORM_MACINTOSH;
-/*        charmap.encoding_id = 0; */
+/*        charmap.encoding_id = TT_MAC_ID_ROMAN; */
         }
 
         error = FT_CMap_New( fnt_cmap_class,