1 /***************************************************************************/ 2 /* */ 3 /* gxvmorx2.c */ 4 /* */ 5 /* TrueTypeGX/AAT morx table validation */ 6 /* body for type2 (Ligature Substitution) subtable. */ 7 /* */ 8 /* Copyright 2005 by suzuki toshiya, Masatake YAMATO, Red Hat K.K., */ 9 /* David Turner, Robert Wilhelm, and Werner Lemberg. */ 10 /* */ 11 /* This file is part of the FreeType project, and may only be used, */ 12 /* modified, and distributed under the terms of the FreeType project */ 13 /* license, LICENSE.TXT. By continuing to use, modify, or distribute */ 14 /* this file you indicate that you have read the license and */ 15 /* understand and accept it fully. */ 16 /* */ 17 /***************************************************************************/ 18 19 /***************************************************************************/ 20 /* */ 21 /* gxvalid is derived from both gxlayout module and otvalid module. */ 22 /* Development of gxlayout is supported by the Information-technology */ 23 /* Promotion Agency(IPA), Japan. */ 24 /* */ 25 /***************************************************************************/ 26 27 28 #include "gxvmorx.h" 29 30 31 /*************************************************************************/ 32 /* */ 33 /* The macro FT_COMPONENT is used in trace mode. It is an implicit */ 34 /* parameter of the FT_TRACE() and FT_ERROR() macros, used to print/log */ 35 /* messages during execution. */ 36 /* */ 37 #undef FT_COMPONENT 38 #define FT_COMPONENT trace_gxvmorx 39 40 41 typedef struct GXV_morx_subtable_type2_StateOptRec_ 42 { 43 FT_ULong ligActionTable; 44 FT_ULong componentTable; 45 FT_ULong ligatureTable; 46 FT_ULong ligActionTable_length; 47 FT_ULong componentTable_length; 48 FT_ULong ligatureTable_length; 49 50 } GXV_morx_subtable_type2_StateOptRec, 51 *GXV_morx_subtable_type2_StateOptRecData; 52 53 54 #define GXV_MORX_SUBTABLE_TYPE2_HEADER_SIZE \ 55 ( GXV_XSTATETABLE_HEADER_SIZE + 4 + 4 + 4 ) 56 57 58 static void gxv_morx_subtable_type2_opttable_load(FT_Bytes table,FT_Bytes limit,GXV_Validator valid)59 gxv_morx_subtable_type2_opttable_load( FT_Bytes table, 60 FT_Bytes limit, 61 GXV_Validator valid ) 62 { 63 FT_Bytes p = table; 64 65 GXV_morx_subtable_type2_StateOptRecData optdata = 66 (GXV_morx_subtable_type2_StateOptRecData)valid->xstatetable.optdata; 67 68 69 GXV_LIMIT_CHECK( 4 + 4 + 4 ); 70 optdata->ligActionTable = FT_NEXT_ULONG( p ); 71 optdata->componentTable = FT_NEXT_ULONG( p ); 72 optdata->ligatureTable = FT_NEXT_ULONG( p ); 73 74 GXV_TRACE(( "offset to ligActionTable=0x%08x\n", 75 optdata->ligActionTable )); 76 GXV_TRACE(( "offset to componentTable=0x%08x\n", 77 optdata->componentTable )); 78 GXV_TRACE(( "offset to ligatureTable=0x%08x\n", 79 optdata->ligatureTable )); 80 } 81 82 83 static void gxv_morx_subtable_type2_subtable_setup(FT_ULong table_size,FT_ULong classTable,FT_ULong stateArray,FT_ULong entryTable,FT_ULong * classTable_length_p,FT_ULong * stateArray_length_p,FT_ULong * entryTable_length_p,GXV_Validator valid)84 gxv_morx_subtable_type2_subtable_setup( FT_ULong table_size, 85 FT_ULong classTable, 86 FT_ULong stateArray, 87 FT_ULong entryTable, 88 FT_ULong* classTable_length_p, 89 FT_ULong* stateArray_length_p, 90 FT_ULong* entryTable_length_p, 91 GXV_Validator valid ) 92 { 93 FT_ULong o[6]; 94 FT_ULong* l[6]; 95 FT_ULong buff[7]; 96 97 GXV_morx_subtable_type2_StateOptRecData optdata = 98 (GXV_morx_subtable_type2_StateOptRecData)valid->xstatetable.optdata; 99 100 101 GXV_NAME_ENTER( "subtable boundaries setup" ); 102 103 o[0] = classTable; 104 o[1] = stateArray; 105 o[2] = entryTable; 106 o[3] = optdata->ligActionTable; 107 o[4] = optdata->componentTable; 108 o[5] = optdata->ligatureTable; 109 l[0] = classTable_length_p; 110 l[1] = stateArray_length_p; 111 l[2] = entryTable_length_p; 112 l[3] = &(optdata->ligActionTable_length); 113 l[4] = &(optdata->componentTable_length); 114 l[5] = &(optdata->ligatureTable_length); 115 116 gxv_set_length_by_ulong_offset( o, l, buff, 6, table_size, valid ); 117 118 GXV_TRACE(( "classTable: offset=0x%08x length=0x%08x\n", 119 classTable, *classTable_length_p )); 120 GXV_TRACE(( "stateArray: offset=0x%08x length=0x%08x\n", 121 stateArray, *stateArray_length_p )); 122 GXV_TRACE(( "entryTable: offset=0x%08x length=0x%08x\n", 123 entryTable, *entryTable_length_p )); 124 GXV_TRACE(( "ligActionTable: offset=0x%08x length=0x%08x\n", 125 optdata->ligActionTable, 126 optdata->ligActionTable_length )); 127 GXV_TRACE(( "componentTable: offset=0x%08x length=0x%08x\n", 128 optdata->componentTable, 129 optdata->componentTable_length )); 130 GXV_TRACE(( "ligatureTable: offset=0x%08x length=0x%08x\n", 131 optdata->ligatureTable, 132 optdata->ligatureTable_length )); 133 134 GXV_EXIT; 135 } 136 137 138 #define GXV_MORX_LIGACTION_ENTRY_SIZE 4 139 140 141 static void gxv_morx_subtable_type2_ligActionIndex_validate(FT_Bytes table,FT_UShort ligActionIndex,GXV_Validator valid)142 gxv_morx_subtable_type2_ligActionIndex_validate( 143 FT_Bytes table, 144 FT_UShort ligActionIndex, 145 GXV_Validator valid ) 146 { 147 /* access ligActionTable */ 148 GXV_morx_subtable_type2_StateOptRecData optdata = 149 (GXV_morx_subtable_type2_StateOptRecData)valid->xstatetable.optdata; 150 151 FT_Bytes lat_base = table + optdata->ligActionTable; 152 FT_Bytes p = lat_base + 153 ligActionIndex * GXV_MORX_LIGACTION_ENTRY_SIZE; 154 FT_Bytes lat_limit = lat_base + optdata->ligActionTable; 155 156 157 if ( p < lat_base ) 158 { 159 GXV_TRACE(( "p < lat_base (%d byte rewind)\n", lat_base - p )); 160 FT_INVALID_OFFSET; 161 } 162 else if ( lat_limit < p ) 163 { 164 GXV_TRACE(( "lat_limit < p (%d byte overrun)\n", p - lat_limit )); 165 FT_INVALID_OFFSET; 166 } 167 168 { 169 /* validate entry in ligActionTable */ 170 FT_ULong lig_action; 171 #ifdef GXV_LOAD_UNUSED_VARS 172 FT_UShort last; 173 FT_UShort store; 174 #endif 175 FT_ULong offset; 176 177 178 lig_action = FT_NEXT_ULONG( p ); 179 #ifdef GXV_LOAD_UNUSED_VARS 180 last = (FT_UShort)( ( lig_action >> 31 ) & 1 ); 181 store = (FT_UShort)( ( lig_action >> 30 ) & 1 ); 182 #endif 183 184 offset = lig_action & 0x3FFFFFFFUL; 185 186 /* this offset is 30-bit signed value to add to GID */ 187 /* it is different from the location offset in mort */ 188 if ( ( offset & 0x3FFF0000UL ) == 0x3FFF0000UL ) 189 { 190 if ( offset + valid->face->num_glyphs > 0x40000000UL ) 191 return; 192 193 GXV_TRACE(( "ligature action table includes" 194 " too negative offset moving all GID" 195 " below defined range: 0x%04x\n", 196 offset & 0xFFFFU )); 197 GXV_SET_ERR_IF_PARANOID( FT_INVALID_OFFSET ); 198 } 199 else if ( ( offset & 0x3FFF0000UL ) == 0x0000000UL ) 200 { 201 if ( offset + valid->face->num_glyphs < 0 ) 202 return; 203 204 GXV_TRACE(( "ligature action table includes" 205 " too large offset moving all GID" 206 " over defined range: 0x%04x\n", 207 offset & 0xFFFFU )); 208 GXV_SET_ERR_IF_PARANOID( FT_INVALID_OFFSET ); 209 } 210 211 GXV_TRACE(( "ligature action table includes" 212 " invalid offset to add to 16-bit GID:" 213 " 0x%08x\n", offset )); 214 GXV_SET_ERR_IF_PARANOID( FT_INVALID_OFFSET ); 215 } 216 } 217 218 219 static void gxv_morx_subtable_type2_entry_validate(FT_UShort state,FT_UShort flags,GXV_StateTable_GlyphOffsetCPtr glyphOffset_p,FT_Bytes table,FT_Bytes limit,GXV_Validator valid)220 gxv_morx_subtable_type2_entry_validate( 221 FT_UShort state, 222 FT_UShort flags, 223 GXV_StateTable_GlyphOffsetCPtr glyphOffset_p, 224 FT_Bytes table, 225 FT_Bytes limit, 226 GXV_Validator valid ) 227 { 228 #ifdef GXV_LOAD_UNUSED_VARS 229 FT_UShort setComponent; 230 FT_UShort dontAdvance; 231 FT_UShort performAction; 232 #endif 233 FT_UShort reserved; 234 FT_UShort ligActionIndex; 235 236 FT_UNUSED( state ); 237 FT_UNUSED( limit ); 238 239 240 #ifdef GXV_LOAD_UNUSED_VARS 241 setComponent = (FT_UShort)( ( flags >> 15 ) & 1 ); 242 dontAdvance = (FT_UShort)( ( flags >> 14 ) & 1 ); 243 performAction = (FT_UShort)( ( flags >> 13 ) & 1 ); 244 #endif 245 246 reserved = (FT_UShort)( flags & 0x1FFF ); 247 ligActionIndex = glyphOffset_p->u; 248 249 if ( reserved > 0 ) 250 GXV_TRACE(( " reserved 14bit is non-zero\n" )); 251 252 if ( 0 < ligActionIndex ) 253 gxv_morx_subtable_type2_ligActionIndex_validate( 254 table, ligActionIndex, valid ); 255 } 256 257 258 static void gxv_morx_subtable_type2_ligatureTable_validate(FT_Bytes table,GXV_Validator valid)259 gxv_morx_subtable_type2_ligatureTable_validate( FT_Bytes table, 260 GXV_Validator valid ) 261 { 262 GXV_morx_subtable_type2_StateOptRecData optdata = 263 (GXV_morx_subtable_type2_StateOptRecData)valid->xstatetable.optdata; 264 265 FT_Bytes p = table + optdata->ligatureTable; 266 FT_Bytes limit = table + optdata->ligatureTable 267 + optdata->ligatureTable_length; 268 269 270 GXV_NAME_ENTER( "morx chain subtable type2 - substitutionTable" ); 271 272 if ( 0 != optdata->ligatureTable ) 273 { 274 /* Apple does not give specification of ligatureTable format */ 275 while ( p < limit ) 276 { 277 FT_UShort lig_gid; 278 279 280 GXV_LIMIT_CHECK( 2 ); 281 lig_gid = FT_NEXT_USHORT( p ); 282 if ( lig_gid < valid->face->num_glyphs ) 283 GXV_SET_ERR_IF_PARANOID( FT_INVALID_GLYPH_ID ); 284 } 285 } 286 287 GXV_EXIT; 288 } 289 290 291 FT_LOCAL_DEF( void ) gxv_morx_subtable_type2_validate(FT_Bytes table,FT_Bytes limit,GXV_Validator valid)292 gxv_morx_subtable_type2_validate( FT_Bytes table, 293 FT_Bytes limit, 294 GXV_Validator valid ) 295 { 296 FT_Bytes p = table; 297 298 GXV_morx_subtable_type2_StateOptRec lig_rec; 299 300 301 GXV_NAME_ENTER( "morx chain subtable type2 (Ligature Substitution)" ); 302 303 GXV_LIMIT_CHECK( GXV_MORX_SUBTABLE_TYPE2_HEADER_SIZE ); 304 305 valid->xstatetable.optdata = 306 &lig_rec; 307 valid->xstatetable.optdata_load_func = 308 gxv_morx_subtable_type2_opttable_load; 309 valid->xstatetable.subtable_setup_func = 310 gxv_morx_subtable_type2_subtable_setup; 311 valid->xstatetable.entry_glyphoffset_fmt = 312 GXV_GLYPHOFFSET_USHORT; 313 valid->xstatetable.entry_validate_func = 314 gxv_morx_subtable_type2_entry_validate; 315 316 gxv_XStateTable_validate( p, limit, valid ); 317 318 p += valid->subtable_length; 319 gxv_morx_subtable_type2_ligatureTable_validate( table, valid ); 320 321 GXV_EXIT; 322 } 323 324 325 /* END */ 326