[Devel] Possible bug in CFF font...

[Ranjiv Sharma]

I was having some problem with a particular CFF font and I traced it
down to the following sequence

01 cff_face_init(...)
02   ...
03   cff_font_load(...)
04      ...
05      font->num_glyphs = font->charstrings_index.count;
06      ...
07      cff_charset_load(., font->num_glyphs, )
08          ...
09          if ( FT_NEW_ARRAY( charset->sids, num_glyphs ) )
10          ...
11      ...
12      if ( dict->cid_registry )
13         root->num_glyphs = dict->cid_count;
14      else
15         root->num_glyphs = cff->charstrings_index.count;
16   FT_CMap_New(...);
17      cff_map_unicode_init(...)
18      count = (FT_UInt)face->root.num_glyphs
19      for ( n = 0; n < count; n++ )
20      {
21        FT_UInt      sid   = charset->sids[n];

Line 09 : charset->sids allocated - Array of 4874
Line 13 : root->num_glyphs set to 20317
Line 18 : count set to 20317
Line 21 : Array overrun on 4874 sids allocated

At line 21 face->root.num_glyphs = 20317 and cff->num_glyphs = 4874

I am assuming that these two values should be in synch.

In my case, I was able to fix the problem by using cff->num_glyphs
instead of face->root.num_glyphs in cff_map_unicode(...), but I'm not
sure if that is the right or the only fix.

-Ranjiv