Commit graph

8496 commits

Author SHA1 Message Date
David Pokora
67c52a0b68 [psaux] Avoid stack overflow.
* src/psaux/t1.decode.c (t1_decoder_parse_charstrings) [op_pop]: Check stack
  size.

Fixes issue #1406.
2026-03-22 06:28:57 +01:00
Werner Lemberg
238dd13d7d * src/psaux/t1decide.c (t1_decoder_parse_charstrings): Fix bounds check.
During charstring processing, the `decoder->len_buildchar` field can be
corrupted.  Avoid this by caching this value in a local variable at function
entry.

Based on a patch submitted by David Pokora <david.pokora@trailofbits.com>.

Fixes issue #1405.
2026-03-22 06:22:31 +01:00
Werner Lemberg
78d65241aa ttnameid.h: Minor documentation improvement. 2026-03-20 08:06:02 +01:00
Werner Lemberg
4130e62d23 * src/sdf/ftsdf.c (sdf_generate_bounding_box): Fix thinko.
Bug introduced in commit bda1d87f69.

We would need an `FT_NEW_ARRAY_MULT` array...

Reported as

  https://issues.oss-fuzz.com/issues/494362618
2026-03-20 07:47:10 +01:00
Alexei Podtelezhnikov
3d7c50d13c [sfnt/COLRv0] Revise sanity checks.
This re-implements 6d62076a and potentially fixes #1404. 

* src/sfnt/ttcolr.c (tt_face_get_colr_layer): Rely on validated total num_layers.
2026-03-19 12:26:32 -04:00
Alexei Podtelezhnikov
5846b6eda6 * src/truetype/ttgload.c (TT_Process_Composite_Glyph): Fix allocation.
Fixes #1403, proposed by Chris Anderson.
2026-03-19 08:18:59 -04:00
Werner Lemberg
bda1d87f69 * src/sdf/ftsdf.c (sdf_generate_bounding_box): Fix allocation.
Reported in

  https://mail.gnu.org/archive/html/freetype-devel/2026-02/msg00005.html
2026-03-18 14:45:57 +01:00
Werner Lemberg
264b5fbf5b Update all copyright notices. 2026-03-11 17:27:07 +01:00
Alexei Podtelezhnikov
99b479dc34 .gitlab-ci.yml: Upgrade Windows pipelines. 2026-03-10 12:17:14 -04:00
Alexei Podtelezhnikov
dc17b79e1a [base] Reintroduce overall rendering limits.
* src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Limit absolute
outline coordinnates to prevent integer issues downstream.
2026-03-09 22:53:06 -04:00
Alexei Podtelezhnikov
e7d2cc6466 * src/base/ftglyph.c (FT_Glyph_To_Bitmap): Fix memory leak.
This leak was introduced in 85c8efe0af by overlooking the
direct `ft_bitmap_glyph_init` call (now gone). Fixes #1399,
also reported earlier:
  https://issues.oss-fuzz.com/issues/482909897.
2026-03-09 22:14:01 -04:00
Alexei Podtelezhnikov
06ec4ef453 * src/raster/ftraster.c (Conic_To, Cubic_To): Avoid UB.
Fixes #1396.
2026-03-09 20:22:45 -04:00
Alexei Podtelezhnikov
bf18015d3a [stroker] Actually validate outlines.
Fixes #1400.

* src/base/ftstroke.c (FT_Glyph_Stroke): Check for `GetCount` error.
(ft_stroke_border_get_counts): Actually return expected error.
(FT_Glyph_Stroke): Minor.
2026-03-09 19:53:30 -04:00
Miguel Sousa
93e7335adb * src/sfnt/ttobjs.c (tt_size_init_bytecode): Be more generous.
Fixes issue #1137.
2026-03-09 21:08:10 +01:00
Werner Lemberg
1c6e43ab90 * src/sfnt/ttgpos.c (tt_face_load_gpos): Correctly release gpos.
This is a follow-up to issue #1398.
2026-03-09 20:34:55 +01:00
Dominik Röttsches
45556a19aa [sfnt] Use array count in sanitization of BaseGlyphPaintRecord list.
* src/sfnt/ttcolr.c (tt_face_load_colr): Compute correct length
  of `BaseGlyphPaintRecord` array size.

Fixes issue #1397.
2026-03-09 10:44:19 +01:00
Werner Lemberg
a1079b181e * src/sfnt/ttgpos.c (tt_face_validate_pair_pos2): Correct limit check.
Fixes issue #1398.
2026-03-09 05:50:43 +01:00
Werner Lemberg
6dc80885f4 * src/truetype/ttgload.c (load_truetype_glyph): Limit recursion.
Fixes issue #1395.
2026-03-09 05:35:01 +01:00
Alexei Podtelezhnikov
31401a3b2d * src/raster/ftraster.c (Set_High_Precision): Limit size.
This should avoid integer overflows:
   https://issues.oss-fuzz.com/issues/490433932
   https://issues.oss-fuzz.com/issues/490464129
2026-03-07 22:46:57 -05:00
Werner Lemberg
aa8ca27f9b [cid] Add boundary check in incremental interface.
* src/cid/cidgload.c (cid_load_glyph) [FT_CONFIG_OPTION_INCREMENTAL]:
  Validate `fd_select`.

Fixes issue #1394.
2026-03-06 07:17:59 +01:00
Werner Lemberg
5d249d8402 * src/sfnt/ttgpos.c (tt_face_get_pair_pos1_kerning): Typo.
This could lead to make FreeType miss some kerning pairs.

Fixes issue #1393.
2026-03-06 06:55:07 +01:00
Werner Lemberg
b2c8a031a2 * src/sfnt/ttgpos.c (tt_face_get_class): Fix range check.
Fixes issue #1392.
2026-03-06 06:32:10 +01:00
Alexei Podtelezhnikov
6995a34628 [base] Adjust rendering limits.
* src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Check width and
height directly. Fixes #1390.
2026-03-05 19:55:31 -05:00
Debbie Goldsmith
d262bd978c [truetype] Reject fonts without 'glyf' and 'loca' table.
* src/truetype/ttobjs.c (tt_face_init): Add check.
2026-03-03 10:39:04 +01:00
Werner Lemberg
02f71ec67a Minor whitespace. 2026-03-03 08:00:15 +01:00
Werner Lemberg
1ac5ed9a44 CMakeLists.txt: Formatting. 2026-03-03 07:25:53 +01:00
Werner Lemberg
bf1f34d75e * subprojects/*: Fix meson wrap files. 2026-03-02 08:30:20 +01:00
Werner Lemberg
f4205da148 * Version 2.14.2 released.
==========================

Tag sources with `VER-2-14-2'.

* docs/VERSION.TXT: Add entry for version 2.14.2.
* docs/CHANGES: Updated.
* docs/release, docs/README, builds/macs/README: Updated.

* README, src/base/ftver.rc, builds/windows/vc2010/index.html,
  builds/windows/visualc/index.html, builds/windows/visualce/index.html,
  builds/wince/vc2005-ce/index.html, builds/wince/vc2008-ce/index.html,
  docs/freetype-config.1: s/2.14.1/2.14.2/, s/2141/2142/.

* include/freetype/freetype.h (FREETYPE_PATCH): Set to 2.

* builds/unix/configure.raw (version_info): Set to 26:5:20.
* CMakeLists.txt (VERSION_PATCH): Set to 2.
2026-03-01 14:55:17 +01:00
Werner Lemberg
8fb4b4ac55 * subprojects/*.wrap: Updated. 2026-03-01 13:56:17 +01:00
Werner Lemberg
109d617da2 Very minor doc fixes. 2026-03-01 12:22:58 +01:00
Alexei Podtelezhnikov
459af335b9 [truetype] Clean up TT_Load_Context.
* src/truetype/ttinterp.c (TT_Load_Context): Remove return type.
* src/truetype/ttinterp.h (TT_Load_Context): Update signature.
* src/truetype/ttobjs.c (tt_size_run_{fpgm,prep}): Update callers.
* src/truetype/ttgload.c (tt_loader_init): Ditto.
2026-02-22 23:13:22 -05:00
Alexei Podtelezhnikov
31db10d922 [truetype] Use FT_QALLOC_MULT.
* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Here.
This call provides builtin overflow protection. See #1382.
2026-02-21 00:03:07 -05:00
Alexei Podtelezhnikov
c111f0713c * src/base/ftbitmap.c (FT_Bitmap_Blend): Use FT_ALLOC_MULT.
This call is fortified with builtin overflow checks.
2026-02-20 23:48:14 -05:00
Alexei Podtelezhnikov
dd66971f3c [sdf] Substitute allocation macros.
* src/sdf/ftsdf.c (sdf_generate_bounding_box,
sdf_generate_with_overlaps): Use more robust macros.
2026-02-20 23:29:30 -05:00
Alexei Podtelezhnikov
be8e126ae0 [base] Clean up bitmap allocations.
* src/base/src/base/ftobjs.c (ft_glyphslot_alloc_bitmap): Use preset
dimensions and call FT_MEM_ALLOC_MULT.
* include/freetype/internal/ftobjs.h (ft_glyphslot_alloc_bitmap):
Updated signature...
* src/*: ... and all callers.
2026-02-20 22:50:50 -05:00
Alexei Podtelezhnikov
156c7ea38f * src/sfnt/ttcolr.c (tt_face_colr_blend_layer): Use FT_ALLOC_MULT.
Fixes #1389. The overflow is detected in ft_mem_qrealloc.
2026-02-20 07:55:43 -05:00
Alexei Podtelezhnikov
85c8efe0af * src/base/ftglyph.c (ft_bitmap_glyph_init): Always copy in full.
Other glyph formats never perform lazy copy.  Fixes #1385.
2026-02-07 19:20:05 -05:00
Alexei Podtelezhnikov
d41d494341 * include/freetype/config/mac-support.h: Check for FT_MACINTOSH.
Fixes warnings reported in !414.
2026-02-07 11:03:25 -05:00
Alexei Podtelezhnikov
e3a0652b6d [pshinter] Merge extrema and inflex analyses.
Any point on the horizontal or vertical segment, which can either
be either extreme or inflection point is now marked.  This makes
separate inflection algorithm unnecessary.  This simplifies the
algorithm without noticeable rendering differences.

* src/pshinter/pshalgo.c (psh_glyph_compute_extrema): Rewrite
to detect both extrema and inflection points. Determine the
their direction instantly.
2026-02-03 20:34:35 -05:00
Alexei Podtelezhnikov
676e8b8637 * src/sfnt/ttgpos.c (tt_face_validate_*): Fix check signedness.
This is an alternative to !398 without signed -1.
2026-02-03 20:16:32 -05:00
Alexei Podtelezhnikov
28407bc8cd * src/sfnt/sfwoff2.c (reconstruct_glyf): Revise variables.
This should fix #1379 while resonstructing the code intent.
2026-01-27 19:41:17 -05:00
Alexei Podtelezhnikov
7cc8f37b9a [base, smooth] Implement direct LCD filtering.
Applying an LCD filter to spans rather than the entire image improves
the performance of ClearType-like rendering by about 40% at 32 ppem
and much more at larger sizes.  Small rounding differences are expected.

* src/smooth/ftsmooth.c (ft_smooth_raster_lcd, ft_smooth_lcd_spans,
ft_smooth_raster_lcdv, ft_smooth_lcdv_spans, TOrigin): Implement it.
* include/freetype/internal/ftobjs.h (FT_LibraryRec): lcd_filter_func gone.
* src/base/ftlcdfil.c (ft_lcd_filter_fir): Removed.
(ft_lcd_padding): Use padding sufficient for any 5-tap filter.
(FT_Library_SetLcdFilterWeights, FT_Library_SetLcdFilter): Updated.
* docs/CHANGES: Updated.
2026-01-26 12:43:28 -05:00
Alexei Podtelezhnikov
e8f0969dcf [base, smooth] Remove LCD filter from face properties.
This removes the internal face property that sets the filtering weights.
The global filtering algorithms and weights are now optimized to work
well under all conditions.

* include/freetype/internal/ftobjs.h (FT_Face_InternalRec): Do it.
* include/freetype/freetype.h (FT_Face_Properties): Revised docs.
* include/freetype/ftparams.h (FT_PARAM_TAG_LCD_FILTER_WEIGHTS): Ditto.
* src/base/ftlcdfil.c (ft_lcd_padding): Updated.
* src/base/ftobjs.c (ft_open_face_internal, FT_Face_Properties): Ditto.
* src/smooth/ftsmooth.c (ft_smooth_render): Ditto.
* docs/CHANGES: Updated.
2026-01-25 15:00:08 -05:00
Alexei Podtelezhnikov
084bf2898b [base] Remove legacy LCD filter.
* src/base/ftlcdfil.c (_ft_lcd_filter_legacy): Removed.
(FT_Library_SetLcdFilter): Updated.
* include/freetype/ftlcdfil.h (FT_LcdFilter): Updated.
* doc/CHANGES: Updated.
2026-01-25 14:51:59 -05:00
Alexei Podtelezhnikov
83f543a82b * src/svg/ftsvg.c: Use FT_ALLOC_MULT.
Fixes #1378.
2026-01-22 09:07:12 -05:00
Harish Raja Selvan
95db5da7c6 * .gitlab-ci.yml: Add MSBuild for ARM64. 2026-01-19 16:30:23 -05:00
Alexei Podtelezhnikov
ef04e4eb20 [base, smooth] Fortify direct rendering.
This is a better fix for #1384, which is rather about signed overflow.

* include/freetype/ftimage.h (FT_Span): Use unsigned position.
* src/smooth/ftgrays.c (gray_sweep_direct): Sync with FT_Span.
* src/smooth/ftsmooth.c (ft_smooth_render): Remove redundant shift.
* src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Readjust limits.
2026-01-17 22:55:16 -05:00
Alexei Podtelezhnikov
dad4640660 [base] Maintain overall rendering limits.
Reject rendering of outlines that stretch beyond 32767 pixels from
the origin,  which is further restricted to 10922 horizontal pixels
for LCD rendering with ClearType-like algorithms. 16-bit FT_Span is
one of the reasons to have this limit imposed, fixes #1384.

* src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Impose global
rendering limits.
2026-01-15 21:09:56 -05:00
Harry Sintonen
a9babbcbc0 * src/autofit/ft-hb-ft.c (ft_hb_ft_reference_table): Use ft_sfree. 2026-01-13 15:39:29 +01:00
Alexei Podtelezhnikov
341049a95b [base] Set ppem-based rendering limits.
Many rendering timeouts occur when the outline stretches far beyond
the Em size.  Limiting the bounding box to 10 Em should reject such
requests.  It is still to possible scribble excessively within the set
limits.  At least, the memory usage will be curtained.

* src/base/ftobjs.c (ft_glyphslot_free_bitmap): Revise limits based
on ppem when available.
2026-01-09 18:22:15 -05:00