Checked in the following released items:

xkeyboard-config-1.4.tar.gz
ttf-bitstream-vera-1.10.tar.gz
font-alias-1.0.1.tar.gz
font-sun-misc-1.0.0.tar.gz
font-sun-misc-1.0.0.tar.gz
font-sony-misc-1.0.0.tar.gz
font-schumacher-misc-1.0.0.tar.gz
font-mutt-misc-1.0.0.tar.gz
font-misc-misc-1.0.0.tar.gz
font-misc-meltho-1.0.0.tar.gz
font-micro-misc-1.0.0.tar.gz
font-jis-misc-1.0.0.tar.gz
font-isas-misc-1.0.0.tar.gz
font-dec-misc-1.0.0.tar.gz
font-daewoo-misc-1.0.0.tar.gz
font-cursor-misc-1.0.0.tar.gz
font-arabic-misc-1.0.0.tar.gz
font-winitzki-cyrillic-1.0.0.tar.gz
font-misc-cyrillic-1.0.0.tar.gz
font-cronyx-cyrillic-1.0.0.tar.gz
font-screen-cyrillic-1.0.1.tar.gz
font-xfree86-type1-1.0.1.tar.gz
font-adobe-utopia-type1-1.0.1.tar.gz
font-ibm-type1-1.0.0.tar.gz
font-bitstream-type1-1.0.0.tar.gz
font-bitstream-speedo-1.0.0.tar.gz
font-bh-ttf-1.0.0.tar.gz
font-bh-type1-1.0.0.tar.gz
font-bitstream-100dpi-1.0.0.tar.gz
font-bh-lucidatypewriter-100dpi-1.0.0.tar.gz
font-bh-100dpi-1.0.0.tar.gz
font-adobe-utopia-100dpi-1.0.1.tar.gz
font-adobe-100dpi-1.0.0.tar.gz
font-util-1.0.1.tar.gz
font-bitstream-75dpi-1.0.0.tar.gz
font-bh-lucidatypewriter-75dpi-1.0.0.tar.gz
font-adobe-utopia-75dpi-1.0.1.tar.gz
font-bh-75dpi-1.0.0.tar.gz
bdftopcf-1.0.1.tar.gz
font-adobe-75dpi-1.0.0.tar.gz
mkfontscale-1.0.6.tar.gz
openssl-0.9.8k.tar.gz
bigreqsproto-1.0.2.tar.gz
xtrans-1.2.2.tar.gz
resourceproto-1.0.2.tar.gz
inputproto-1.4.4.tar.gz
compositeproto-0.4.tar.gz
damageproto-1.1.0.tar.gz
zlib-1.2.3.tar.gz
xkbcomp-1.0.5.tar.gz
freetype-2.3.9.tar.gz
pthreads-w32-2-8-0-release.tar.gz
pixman-0.12.0.tar.gz
kbproto-1.0.3.tar.gz
evieext-1.0.2.tar.gz
fixesproto-4.0.tar.gz
recordproto-1.13.2.tar.gz
randrproto-1.2.2.tar.gz
scrnsaverproto-1.1.0.tar.gz
renderproto-0.9.3.tar.gz
xcmiscproto-1.1.2.tar.gz
fontsproto-2.0.2.tar.gz
xextproto-7.0.3.tar.gz
xproto-7.0.14.tar.gz
libXdmcp-1.0.2.tar.gz
libxkbfile-1.0.5.tar.gz
libfontenc-1.0.4.tar.gz
libXfont-1.3.4.tar.gz
libX11-1.1.5.tar.gz
libXau-1.0.4.tar.gz
libxcb-1.1.tar.gz
xorg-server-1.5.3.tar.gz

1 files changed, 184 insertions, 0 deletions

diff --git a/freetype/src/gxvalid/gxvmorx.c b/freetype/src/gxvalid/gxvmorx.c
new file mode 100644
index 000000000..d217940ea
--- /dev/null
+++ b/freetype/src/gxvalid/gxvmorx.c
@@ -0,0 +1,184 @@
+/***************************************************************************/
+/*                                                                         */
+/*  gxvmorx.c                                                              */
+/*                                                                         */
+/*    TrueTypeGX/AAT morx table validation (body).                         */
+/*                                                                         */
+/*  Copyright 2005, 2008 by                                                */
+/*  suzuki toshiya, Masatake YAMATO, Red Hat K.K.,                         */
+/*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
+/*                                                                         */
+/*  This file is part of the FreeType project, and may only be used,       */
+/*  modified, and distributed under the terms of the FreeType project      */
+/*  license, LICENSE.TXT.  By continuing to use, modify, or distribute     */
+/*  this file you indicate that you have read the license and              */
+/*  understand and accept it fully.                                        */
+/*                                                                         */
+/***************************************************************************/
+
+/***************************************************************************/
+/*                                                                         */
+/* gxvalid is derived from both gxlayout module and otvalid module.        */
+/* Development of gxlayout is supported by the Information-technology      */
+/* Promotion Agency(IPA), Japan.                                           */
+/*                                                                         */
+/***************************************************************************/
+
+
+#include "gxvmorx.h"
+
+
+  /*************************************************************************/
+  /*                                                                       */
+  /* The macro FT_COMPONENT is used in trace mode.  It is an implicit      */
+  /* parameter of the FT_TRACE() and FT_ERROR() macros, used to print/log  */
+  /* messages during execution.                                            */
+  /*                                                                       */
+#undef  FT_COMPONENT
+#define FT_COMPONENT  trace_gxvmorx
+
+
+  static void
+  gxv_morx_subtables_validate( FT_Bytes       table,
+                               FT_Bytes       limit,
+                               FT_UShort      nSubtables,
+                               GXV_Validator  valid )
+  {
+    FT_Bytes  p = table;
+
+    GXV_Validate_Func fmt_funcs_table[] =
+    {
+      gxv_morx_subtable_type0_validate, /* 0 */
+      gxv_morx_subtable_type1_validate, /* 1 */
+      gxv_morx_subtable_type2_validate, /* 2 */
+      NULL,                             /* 3 */
+      gxv_morx_subtable_type4_validate, /* 4 */
+      gxv_morx_subtable_type5_validate, /* 5 */
+
+    };
+
+    GXV_Validate_Func  func;
+
+    FT_UShort  i;
+
+
+    GXV_NAME_ENTER( "subtables in a chain" );
+
+    for ( i = 0; i < nSubtables; i++ )
+    {
+      FT_ULong  length;
+      FT_ULong  coverage;
+      FT_ULong  subFeatureFlags;
+      FT_UInt   type;
+      FT_UInt   rest;
+
+
+      GXV_LIMIT_CHECK( 4 + 4 + 4 );
+      length          = FT_NEXT_ULONG( p );
+      coverage        = FT_NEXT_ULONG( p );
+      subFeatureFlags = FT_NEXT_ULONG( p );
+
+      GXV_TRACE(( "validating chain subtable %d/%d (%d bytes)\n",
+                  i + 1, nSubtables, length ));
+
+      type = coverage & 0x0007;
+      rest = length - ( 4 + 4 + 4 );
+      GXV_LIMIT_CHECK( rest );
+
+      /* morx coverage consists of mort_coverage & 16bit padding */
+      gxv_mort_coverage_validate( (FT_UShort)( ( coverage >> 16 ) | coverage ),
+                                  valid );
+      if ( type > 5 )
+        FT_INVALID_FORMAT;
+
+      func = fmt_funcs_table[type];
+      if ( func == NULL )
+        GXV_TRACE(( "morx type %d is reserved\n", type ));
+
+      func( p, p + rest, valid );
+
+      p += rest;
+    }
+
+    valid->subtable_length = p - table;
+
+    GXV_EXIT;
+  }
+
+
+  static void
+  gxv_morx_chain_validate( FT_Bytes       table,
+                           FT_Bytes       limit,
+                           GXV_Validator  valid )
+  {
+    FT_Bytes  p = table;
+    FT_ULong  defaultFlags;
+    FT_ULong  chainLength;
+    FT_ULong  nFeatureFlags;
+    FT_ULong  nSubtables;
+
+
+    GXV_NAME_ENTER( "morx chain header" );
+
+    GXV_LIMIT_CHECK( 4 + 4 + 4 + 4 );
+    defaultFlags  = FT_NEXT_ULONG( p );
+    chainLength   = FT_NEXT_ULONG( p );
+    nFeatureFlags = FT_NEXT_ULONG( p );
+    nSubtables    = FT_NEXT_ULONG( p );
+
+    /* feature-array of morx is same with that of mort */
+    gxv_mort_featurearray_validate( p, limit, nFeatureFlags, valid );
+    p += valid->subtable_length;
+
+    if ( nSubtables >= 0x10000L )
+      FT_INVALID_DATA;
+
+    gxv_morx_subtables_validate( p, table + chainLength,
+                                 (FT_UShort)nSubtables, valid );
+
+    valid->subtable_length = chainLength;
+
+    GXV_EXIT;
+  }
+
+
+  FT_LOCAL_DEF( void )
+  gxv_morx_validate( FT_Bytes      table,
+                     FT_Face       face,
+                     FT_Validator  ftvalid )
+  {
+    GXV_ValidatorRec  validrec;
+    GXV_Validator     valid = &validrec;
+    FT_Bytes          p     = table;
+    FT_Bytes          limit = 0;
+    FT_ULong          version;
+    FT_ULong          nChains;
+    FT_ULong          i;
+
+
+    valid->root = ftvalid;
+    valid->face = face;
+
+    FT_TRACE3(( "validating `morx' table\n" ));
+    GXV_INIT;
+
+    GXV_LIMIT_CHECK( 4 + 4 );
+    version = FT_NEXT_ULONG( p );
+    nChains = FT_NEXT_ULONG( p );
+
+    if ( version != 0x00020000UL )
+      FT_INVALID_FORMAT;
+
+    for ( i = 0; i < nChains; i++ )
+    {
+      GXV_TRACE(( "validating chain %d/%d\n", i + 1, nChains ));
+      GXV_32BIT_ALIGNMENT_VALIDATE( p - table );
+      gxv_morx_chain_validate( p, limit, valid );
+      p += valid->subtable_length;
+    }
+
+    FT_TRACE4(( "\n" ));
+  }
+
+
+/* END */