Re: Problems with type1z and Subrs parsing

[David Turner]

Hi Tom,

  thanks again for your patch, it has been applied.

  I have also found the source of the SEG fault, and it
  was a really stupid bug (forgetting to initialise a
  few blend tables correctly).. Aaarg..

  I have no problem with the fonts I have here. Could
  interested parties test the latest CVS version with the
  fonts they own ??

Thanks for all,

- David

Tom Kacvinsky a écrit :
> 
> Hi all,
> 
> I just found an error in the type1z module.
> 
> This all started with an investigation of why certain MM fonts (or
> instances thereof) were failing.
> 
> I removed the type1 source tree from the full freetype2 tree and
> modified include/free/config/ftmodule.h so that the type1z module and
> not the type1 module were compiled into the library.  Probably a
> simpler way of doing this; but I wanted to make sure that the type1z
> and only the type1z parser got used.
> 
> The problem can be described thusly.
> 
> the function parse_subrs uses the loop
> 
>     for ( n = 0; n < loader->num_subrs; n++ )
> 
> where num_subrs is obtained from parsing /Subrs <some number> array.
> The problem is that num_subrs can be an overestimate of the number
> of subroutines actually defined.  In particular, dvips' old font
> subsetter and Ed Kohler's mmpfb will leave out unused subroutines,
> but make sure the number reported in /Subrs ... array is one more
> than the highest subr. index used in any one charstring.
> 
> Now, we are going to parse past the end of the subrs data and into the
> charstrings data and get a failure in read_binary_data.
> 
> Attached is *simple* patch that fixes this.  It was tested with some
> of the problem fonts I had laying around.  Davis, it would be
> interesting to see if this fixes the problems with some of the fonts
> you have...
> 
> Regards,
> 
> Tom
> 
>   
> ------------------------------------------------------------------------------------------------------------------------------------------------------
>                   Name: z1load.diff
>    z1load.diff    Type: Plain Text (TEXT/PLAIN)
>               Encoding: BASE64