Fix the mystery bug!
A couple bugs joined forces to exhibit the mystery behavior of
crashes / infinite loops on OS X / wrong kerning / invalid memory
access. Pooh!
The bugs were involved:
- Wrong pointer math with ValueRecord in PairPosFormat1
- Fallout from avoiding flex arrays, code not correctly updated
to remove sizeof() usage.
We strictly never use sizeof() directly now. And the PairPos code
is cleaned up. Should fix them all. Bugs are:
Bug 605655 - Pango 1.26.2 introduces kerning bug
Bug 611229 - Pango reads from uninitialized memory
Bug 593240 - (pangoosx) Crash / infinite loop with Mac OS X
We were also doing wrong math converting Device adjustments to
hb_position_t. Fallout from FreeType days. Should shift 16, not
6. Fixed that too.
There's still another bug: we don't sanitize Device records
referenced from value records. Fixing that also.
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 6dc3e30..836a98f 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -50,8 +50,8 @@
#define CONST_NEXT(T,X) (*(reinterpret_cast<const T *>(CONST_CHARP(&(X)) + (X).get_size ())))
#define NEXT(T,X) (*(reinterpret_cast<T *>(CHARP(&(X)) + (X).get_size ())))
-#define CONST_ARRAY_AFTER(T,X) ((reinterpret_cast<const T *>(CONST_CHARP(&(X)) + sizeof (X))))
-#define ARRAY_AFTER(T,X) ((reinterpret_cast<T *>(CHARP(&(X)) + sizeof (X))))
+#define CONST_ARRAY_AFTER(T,X) ((reinterpret_cast<const T *>(CONST_CHARP(&(X)) + X.get_size ())))
+#define ARRAY_AFTER(T,X) ((reinterpret_cast<T *>(CHARP(&(X)) + X.get_size ())))
/*
* Class features
@@ -363,6 +363,7 @@
#define DEFINE_INT_TYPE1(NAME, TYPE, BIG_ENDIAN, BYTES) \
struct NAME \
{ \
+ static inline unsigned int get_size () { return BYTES; } \
inline NAME& set (TYPE i) { BIG_ENDIAN##_put_unaligned(v, i); return *this; } \
inline operator TYPE(void) const { return BIG_ENDIAN##_get_unaligned (v); } \
inline bool operator== (NAME o) const { return BIG_ENDIAN##_cmp_unaligned (v, o.v); } \
@@ -425,7 +426,7 @@
static uint32_t CalcTableChecksum (ULONG *Table, uint32_t Length)
{
uint32_t Sum = 0L;
- ULONG *EndPtr = Table+((Length+3) & ~3) / sizeof(ULONG);
+ ULONG *EndPtr = Table+((Length+3) & ~3) / ULONG::get_size ();
while (Table < EndPtr)
Sum += *Table++;
@@ -530,7 +531,7 @@
return const_array()[i];
}
inline unsigned int get_size () const
- { return sizeof (len) + len * sizeof (Type); }
+ { return len.get_size () + len * Type::get_size (); }
inline bool sanitize (SANITIZE_ARG_DEF) {
TRACE_SANITIZE ();
@@ -633,7 +634,7 @@
return const_array()[i-1];
}
inline unsigned int get_size () const
- { return sizeof (len) + (len ? len - 1 : 0) * sizeof (Type); }
+ { return len.get_size () + (len ? len - 1 : 0) * Type::get_size (); }
inline bool sanitize (SANITIZE_ARG_DEF) {
TRACE_SANITIZE ();
