1 files changed, 36 insertions, 12 deletions

diff --git a/freetype/src/cff/cf2ft.c b/freetype/src/cff/cf2ft.c
index c09a0244a..cb8d31c53 100644
--- a/freetype/src/cff/cf2ft.c
+++ b/freetype/src/cff/cf2ft.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType Glue Component to Adobe's Interpreter (body).               */
 /*                                                                         */
-/*  Copyright 2013 Adobe Systems Incorporated.                             */
+/*  Copyright 2013-2014 Adobe Systems Incorporated.                        */
 /*                                                                         */
 /*  This software, and all works of authorship, whether in source or       */
 /*  object code form as indicated by the copyright notice(s) included      */
@@ -61,7 +61,9 @@
 
     FT_ASSERT( unitsPerEm > 0 );
 
-    FT_ASSERT( transform->a > 0 && transform->d > 0 );
+    if ( transform->a <= 0 || transform->d <= 0 )
+      return FT_THROW( Invalid_Size_Handle );
+
     FT_ASSERT( transform->b == 0 && transform->c == 0 );
     FT_ASSERT( transform->tx == 0 && transform->ty == 0 );
 
@@ -236,10 +238,8 @@
 
     if ( *hinted )
     {
-      *x_scale = FT_DivFix( decoder->builder.glyph->x_scale,
-                            cf2_intToFixed( 64 ) );
-      *y_scale = FT_DivFix( decoder->builder.glyph->y_scale,
-                            cf2_intToFixed( 64 ) );
+      *x_scale = ( decoder->builder.glyph->x_scale + 32 ) / 64;
+      *y_scale = ( decoder->builder.glyph->y_scale + 32 ) / 64;
     }
     else
     {
@@ -344,13 +344,25 @@
       if ( scaled && !driver->no_stem_darkening )
         font->renderingFlags |= CF2_FlagsDarkened;
 
+      font->darkenParams[0] = driver->darken_params[0];
+      font->darkenParams[1] = driver->darken_params[1];
+      font->darkenParams[2] = driver->darken_params[2];
+      font->darkenParams[3] = driver->darken_params[3];
+      font->darkenParams[4] = driver->darken_params[4];
+      font->darkenParams[5] = driver->darken_params[5];
+      font->darkenParams[6] = driver->darken_params[6];
+      font->darkenParams[7] = driver->darken_params[7];
+
       /* now get an outline for this glyph;      */
       /* also get units per em to validate scale */
       font->unitsPerEm = (CF2_Int)cf2_getUnitsPerEm( decoder );
 
-      error2 = cf2_checkTransform( &transform, font->unitsPerEm );
-      if ( error2 )
-        return error2;
+      if ( scaled )
+      {
+        error2 = cf2_checkTransform( &transform, font->unitsPerEm );
+        if ( error2 )
+          return error2;
+      }
 
       error2 = cf2_getGlyphOutline( font, &buf, &transform, &glyphWidth );
       if ( error2 )
@@ -380,8 +392,16 @@
     FT_ASSERT( decoder                          &&
                decoder->builder.face            &&
                decoder->builder.face->root.size );
-    FT_ASSERT( decoder->builder.face->root.size->metrics.y_ppem );
 
+    /*
+     * Note that `y_ppem' can be zero if there wasn't a call to
+     * `FT_Set_Char_Size' or something similar.  However, this isn't a
+     * problem since we come to this place in the code only if
+     * FT_LOAD_NO_SCALE is set (the other case gets caught by
+     * `cf2_checkTransform').  The ppem value is needed to compute the stem
+     * darkening, which is disabled for getting the unscaled outline.
+     *
+     */
     return cf2_intToFixed(
              decoder->builder.face->root.size->metrics.y_ppem );
   }
@@ -499,7 +519,7 @@
                               CF2_UInt      idx,
                               CF2_Buffer    buf )
   {
-    FT_ASSERT( decoder && decoder->globals );
+    FT_ASSERT( decoder );
 
     FT_ZERO( buf );
 
@@ -507,6 +527,8 @@
     if ( idx >= decoder->num_globals )
       return TRUE;     /* error */
 
+    FT_ASSERT( decoder->globals );
+
     buf->start =
     buf->ptr   = decoder->globals[idx];
     buf->end   = decoder->globals[idx + 1];
@@ -572,7 +594,7 @@
                              CF2_UInt      idx,
                              CF2_Buffer    buf )
   {
-    FT_ASSERT( decoder && decoder->locals );
+    FT_ASSERT( decoder );
 
     FT_ZERO( buf );
 
@@ -580,6 +602,8 @@
     if ( idx >= decoder->num_locals )
       return TRUE;     /* error */
 
+    FT_ASSERT( decoder->locals );
+
     buf->start =
     buf->ptr   = decoder->locals[idx];
     buf->end   = decoder->locals[idx + 1];