From 54abd22891bd51ef8b533b24df53b3019b5cee81 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 15 Nov 2014 08:05:22 +0000
Subject: [sfnt] Fix Savannah bug #43597.

* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
bitmaps.

From b3500af717010137046ec4076d1e1c0641e33727 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Wed, 19 Nov 2014 20:28:21 +0000
Subject: Change some fields in `FT_Bitmap' to unsigned type.

This doesn't break ABI.

* include/ftimage.h (FT_Bitmap): Make `rows', `width', `num_grays',
`pixel_mode', and `palette_mode' unsigned types.

* src/base/ftbitmap.c: Updated.
(FT_Bitmap_Copy): Fix casts.

* src/cache/ftcsbits.c, src/raster/ftraster.c, src/sfnt/pngshim.c:
Updated.

---
Index: freetype-2.3.7/include/freetype/ftimage.h
===================================================================
--- freetype-2.3.7.orig/include/freetype/ftimage.h
+++ freetype-2.3.7/include/freetype/ftimage.h
@@ -279,13 +279,13 @@ FT_BEGIN_HEADER
   /*                                                                       */
   typedef struct  FT_Bitmap_
   {
-    int             rows;
-    int             width;
+    unsigned int    rows;
+    unsigned int    width;
     int             pitch;
     unsigned char*  buffer;
-    short           num_grays;
-    char            pixel_mode;
-    char            palette_mode;
+    unsigned short  num_grays;
+    unsigned char   pixel_mode;
+    unsigned char   palette_mode;
     void*           palette;
 
   } FT_Bitmap;
Index: freetype-2.3.7/src/base/ftbitmap.c
===================================================================
--- freetype-2.3.7.orig/src/base/ftbitmap.c
+++ freetype-2.3.7/src/base/ftbitmap.c
@@ -60,7 +60,7 @@
 
     if ( pitch < 0 )
       pitch = -pitch;
-    size = (FT_ULong)( pitch * source->rows );
+    size = (FT_ULong)pitch * source->rows;
 
     if ( target->buffer )
     {
@@ -70,7 +70,7 @@
 
       if ( target_pitch < 0  )
         target_pitch = -target_pitch;
-      target_size = (FT_ULong)( target_pitch * target->rows );
+      target_size = (FT_ULong)target_pitch * target->rows;
 
       if ( target_size != size )
         (void)FT_QREALLOC( target->buffer, target_size, size );
@@ -104,7 +104,7 @@
     int             pitch;
     int             new_pitch;
     FT_UInt         bpp;
-    FT_Int          i, width, height;
+    FT_UInt         i, width, height;
     unsigned char*  buffer;
 
 
@@ -142,17 +142,17 @@
     if ( ypixels == 0 && new_pitch <= pitch )
     {
       /* zero the padding */
-      FT_Int  bit_width = pitch * 8;
-      FT_Int  bit_last  = ( width + xpixels ) * bpp;
+      FT_UInt  bit_width = pitch * 8;
+      FT_UInt  bit_last  = ( width + xpixels ) * bpp;
 
 
       if ( bit_last < bit_width )
       {
         FT_Byte*  line  = bitmap->buffer + ( bit_last >> 3 );
         FT_Byte*  end   = bitmap->buffer + pitch;
-        FT_Int    shift = bit_last & 7;
+        FT_UInt   shift = bit_last & 7;
         FT_UInt   mask  = 0xFF00U >> shift;
-        FT_Int    count = height;
+        FT_UInt   count = height;
 
 
         for ( ; count > 0; count--, line += pitch, end += pitch )
@@ -178,7 +178,7 @@
 
     if ( bitmap->pitch > 0 )
     {
-      FT_Int  len = ( width * bpp + 7 ) >> 3;
+      FT_UInt  len = ( width * bpp + 7 ) >> 3;
 
 
       for ( i = 0; i < bitmap->rows; i++ )
@@ -187,7 +187,7 @@
     }
     else
     {
-      FT_Int  len = ( width * bpp + 7 ) >> 3;
+      FT_UInt  len = ( width * bpp + 7 ) >> 3;
 
 
       for ( i = 0; i < bitmap->rows; i++ )
@@ -218,7 +218,8 @@
   {
     FT_Error        error;
     unsigned char*  p;
-    FT_Int          i, x, y, pitch;
+    FT_Int          i, x, pitch;
+    FT_UInt         y;
     FT_Int          xstr, ystr;
 
 
@@ -389,8 +390,8 @@
     case FT_PIXEL_MODE_GRAY2:
     case FT_PIXEL_MODE_GRAY4:
       {
-        FT_Int   pad;
-        FT_Long  old_size;
+        FT_Int    pad;
+        FT_ULong  old_size;
 
 
         old_size = target->rows * target->pitch;
Index: freetype-2.3.7/src/cache/ftcsbits.c
===================================================================
--- freetype-2.3.7.orig/src/cache/ftcsbits.c
+++ freetype-2.3.7/src/cache/ftcsbits.c
@@ -139,12 +139,12 @@
         goto BadGlyph;
       }
 
-      /* Check that our values fit into 8-bit containers!       */
+      /* Check whether our values fit into 8-bit containers!    */
       /* If this is not the case, our bitmap is too large       */
       /* and we will leave it as `missing' with sbit.buffer = 0 */
 
-#define CHECK_CHAR( d )  ( temp = (FT_Char)d, temp == d )
-#define CHECK_BYTE( d )  ( temp = (FT_Byte)d, temp == d )
+#define CHECK_CHAR( d )  ( temp = (FT_Char)d, (FT_Int) temp == (FT_Int) d )
+#define CHECK_BYTE( d )  ( temp = (FT_Byte)d, (FT_UInt)temp == (FT_UInt)d )
 
       /* horizontal advance in pixels */
       xadvance = ( slot->advance.x + 32 ) >> 6;
Index: freetype-2.3.7/src/raster/ftraster.c
===================================================================
--- freetype-2.3.7.orig/src/raster/ftraster.c
+++ freetype-2.3.7/src/raster/ftraster.c
@@ -2368,7 +2368,7 @@ static const char  count_table[256] =
 
         e1 = TRUNC( e1 );
 
-        if ( e1 >= 0 && e1 < ras.target.rows )
+        if ( e1 >= 0 && (ULong)e1 < ras.target.rows )
         {
           PByte  p;
 
@@ -2460,9 +2460,9 @@ static const char  count_table[256] =
         if ( ras.target.pitch > 0 )
           bits += ( ras.target.rows - 1 ) * ras.target.pitch;
 
-        if ( e1 >= 0              &&
-             e1 < ras.target.rows &&
-             *bits & f1           )
+        if ( e1 >= 0                     &&
+             (ULong)e1 < ras.target.rows &&
+             *bits & f1                  )
           return;
       }
       else
@@ -2474,7 +2474,7 @@ static const char  count_table[256] =
 
     e1 = TRUNC( pxl );
 
-    if ( e1 >= 0 && e1 < ras.target.rows )
+    if ( e1 >= 0 && (ULong)e1 < ras.target.rows )
     {
       bits -= e1 * ras.target.pitch;
       if ( ras.target.pitch > 0 )
