Attachment #86201 for bug #124828

Lines 52-57 Link Here

(-)a/include/freetype/fterrdef.h (+2 lines)
52	"broken table" )	52	"broken table" )
53	FT_ERRORDEF_( Invalid_Offset, 0x09, \	53	FT_ERRORDEF_( Invalid_Offset, 0x09, \
54	"broken offset within table" )	54	"broken offset within table" )
		55	FT_ERRORDEF_( Array_Too_Large, 0x0A, \
		56	"array allocation size too large" )
55		57
56	/* glyph/character errors */	58	/* glyph/character errors */
57		59




  /*************************************************************************/


 /* C++ absolutely hates statements like p = (void*)anything; where 'p' is
  * a typed pointer. Since we don't have a typeof operator in standard C++,
  * we need some really ugly casts, like:
  */
#ifdef __cplusplus
#  define  FT_ASSIGNP(p,val)  *((void**)&(p)) = (val)
#else
#  define  FT_ASSIGNP(p,val)  (p) = (val)
#endif



#ifdef FT_DEBUG_MEMORY

  FT_BASE( const char* )  _ft_debug_file;
  FT_BASE( long )         _ft_debug_lineno;

#  define FT_DEBUG_INNER( exp )  ( _ft_debug_file   = __FILE__, \
                                   _ft_debug_lineno = __LINE__, \
                                   (exp) )

#  define FT_ASSIGNP_INNER( p, exp )  ( _ft_debug_file   = __FILE__, \
                                        _ft_debug_lineno = __LINE__, \
                                        FT_ASSIGNP( p, exp ) )

#else /* !FT_DEBUG_MEMORY */

#  define FT_DEBUG_INNER( exp )       (exp)
#  define FT_ASSIGNP_INNER( p, exp )  FT_ASSIGNP( p, exp )

#endif /* !FT_DEBUG_MEMORY */


  /*


  FT_BASE( FT_Pointer )
  ft_mem_realloc( FT_Memory  memory,
                  FT_Long    item_size,
                  FT_Long    cur_count,
                  FT_Long    new_count,
                  void*      block,
                  FT_Error  *p_error );

  FT_BASE( FT_Pointer )
  ft_mem_qrealloc( FT_Memory  memory,
                   FT_Long    item_size,
                   FT_Long    cur_count,
                   FT_Long    new_count,
                   void*      block,
                   FT_Error  *p_error );


               const void*  P );


#define FT_MEM_ALLOC( ptr, size )                                          \
          FT_ASSIGNP_INNER( ptr, ft_mem_alloc( memory, (size), &error ) )

  FT_BASE( FT_Pointer )
  ft_mem_alloc_debug( FT_Memory    memory,
                      FT_Long      size,
                      FT_Error    *p_error,
                      const char*  file_name,
                      FT_Long      line_no );

  FT_BASE( FT_Pointer )
  ft_mem_qalloc_debug( FT_Memory    memory,
                       FT_Long      size,
                       FT_Error    *p_error,
                       const char*  file_name,
                       FT_Long      line_no );

  FT_BASE( FT_Pointer )
  ft_mem_realloc_debug( FT_Memory    memory,
                        FT_Long      current,
                        FT_Long      size,
                        void*        P,
                        FT_Error    *p_error,
                        const char*  file_name,
                        FT_Long      line_no );

  FT_BASE( FT_Pointer )
  ft_mem_qrealloc_debug( FT_Memory    memory,
                         FT_Long      current,
                         FT_Long      size,
                         void*        P,
                         FT_Error    *p_error,
                         const char*  file_name,
                         FT_Long      line_no );

  FT_BASE( void )
  ft_mem_free_debug( FT_Memory    memory,
                     const void  *P,
                     const char*  file_name,
                     FT_Long      line_no );


#define FT_MEM_ALLOC( _pointer_, _size_ )                           \
          (_pointer_) = ft_mem_alloc_debug( memory, _size_, &error, \
                                            __FILE__, __LINE__ )

#define FT_MEM_REALLOC( _pointer_, _current_, _size_ )                   \
          (_pointer_) = ft_mem_realloc_debug( memory, _current_, _size_, \
                                              (_pointer_), &error,       \
                                              __FILE__, __LINE__ )

#define FT_MEM_QALLOC( _pointer_, _size_ )                           \
          (_pointer_) = ft_mem_qalloc_debug( memory, _size_, &error, \
                                             __FILE__, __LINE__ )

#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ )                   \
          (_pointer_) = ft_mem_qrealloc_debug( memory, _current_, _size_, \
                                               (_pointer_), &error,       \
                                               __FILE__, __LINE__ )

#define FT_MEM_FREE( _pointer_ )                                            \
          FT_BEGIN_STMNT                                                    \
            if ( _pointer_ )                                                \
            {                                                               \
              ft_mem_free_debug( memory, (_pointer_), __FILE__, __LINE__ ); \
              (_pointer_) = NULL;                                           \
            }                                                               \
          FT_END_STMNT


#else  /* !FT_DEBUG_MEMORY */


#define FT_MEM_FREE( ptr )                \
          FT_BEGIN_STMNT                  \
            ft_mem_free( memory, (ptr) ); \
            (ptr) = NULL;                 \
          FT_BEGIN_STMNT                          \
            if ( (_pointer_) )                    \
            {                                     \
              ft_mem_free( memory, (_pointer_) ); \
              (_pointer_) = NULL;                 \
            }                                     \
          FT_END_STMNT

#define FT_MEM_NEW( ptr )                        \
          FT_MEM_ALLOC( ptr, sizeof ( *(ptr) ) )
                                        (_pointer_), &error )

#define FT_MEM_QALLOC( _pointer_, _size_ )                      \
          (_pointer_) = ft_mem_qalloc( memory, _size_, &error )

#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ )             \
          (_pointer_) = ft_mem_qrealloc( memory, _current_, _size_, \
                                         (_pointer_), &error )

#endif /* !FT_DEBUG_MEMORY */


#define  FT_MEM_SET_ERROR( cond )  ( (cond), error != 0 )


#else /* !FT_STRICT_ALIASING */


#ifdef FT_DEBUG_MEMORY


  FT_BASE( FT_Error )
  ft_mem_alloc_debug( FT_Memory    memory,
                      FT_Long      size,
                      void*       *P,
                      const char*  file_name,
                      FT_Long      line_no );

  FT_BASE( FT_Error )
  ft_mem_qalloc_debug( FT_Memory    memory,
                       FT_Long      size,
                       void*       *P,
                       const char*  file_name,
                       FT_Long      line_no );

  FT_BASE( FT_Error )
  ft_mem_realloc_debug( FT_Memory    memory,
                        FT_Long      current,
                        FT_Long      size,
                        void*       *P,
                        const char*  file_name,
                        FT_Long      line_no );

  FT_BASE( FT_Error )
  ft_mem_qrealloc_debug( FT_Memory    memory,
                         FT_Long      current,
                         FT_Long      size,
                         void*       *P,
                         const char*  file_name,
                         FT_Long      line_no );

  FT_BASE( void )
  ft_mem_free_debug( FT_Memory    memory,
                     FT_Pointer   block,
                     const char*  file_name,
                     FT_Long      line_no );


#endif /* FT_DEBUG_MEMORY */


  /*************************************************************************/
  /*                                                                       */
  /* <Function>                                                            */
  /*    ft_mem_alloc                                                       */
  /*                                                                       */
  /* <Description>                                                         */
  /*    Allocates a new block of memory.  The returned area is always      */
  /*    zero-filled; this is a strong convention in many FreeType parts.   */
  /*                                                                       */
  /* <Input>                                                               */
  /*    memory :: A handle to a given `memory object' which handles        */
  /*              allocation.                                              */
  /*                                                                       */
  /*    size   :: The size in bytes of the block to allocate.              */
  /*                                                                       */
  /* <Output>                                                              */
  /*    P      :: A pointer to the fresh new block.  It should be set to   */
  /*              NULL if `size' is 0, or in case of error.                */
  /*                                                                       */
  /* <Return>                                                              */
  /*    FreeType error code.  0 means success.                             */
  /*                                                                       */
  FT_BASE( FT_Error )
  ft_mem_alloc( FT_Memory  memory,
                FT_Long    size,
                void*     *P );


  /*************************************************************************/
  /*                                                                       */
  /* <Function>                                                            */
  /*    ft_mem_qalloc                                                      */
  /*                                                                       */
  /* <Description>                                                         */
  /*    Allocates a new block of memory.  The returned area is *not*       */
  /*    zero-filled, making allocation quicker.                            */
  /*                                                                       */
  /* <Input>                                                               */
  /*    memory :: A handle to a given `memory object' which handles        */
  /*              allocation.                                              */
  /*                                                                       */
  /*    size   :: The size in bytes of the block to allocate.              */
  /*                                                                       */
  /* <Output>                                                              */
  /*    P      :: A pointer to the fresh new block.  It should be set to   */
  /*              NULL if `size' is 0, or in case of error.                */
  /*                                                                       */
  /* <Return>                                                              */
  /*    FreeType error code.  0 means success.                             */
  /*                                                                       */
  FT_BASE( FT_Error )
  ft_mem_qalloc( FT_Memory  memory,
                 FT_Long    size,
                 void*     *p );


  /*************************************************************************/
  /*                                                                       */
  /* <Function>                                                            */
  /*    ft_mem_realloc                                                     */
  /*                                                                       */
  /* <Description>                                                         */
  /*    Reallocates a block of memory pointed to by `*P' to `Size' bytes   */
  /*    from the heap, possibly changing `*P'.  The returned area is       */
  /*    zero-filled.                                                       */
  /*                                                                       */
  /* <Input>                                                               */
  /*    memory  :: A handle to a given `memory object' which handles       */
  /*               reallocation.                                           */
  /*                                                                       */
  /*    current :: The current block size in bytes.                        */
  /*                                                                       */
  /*    size    :: The new block size in bytes.                            */
  /*                                                                       */
  /* <InOut>                                                               */
  /*    P       :: A pointer to the fresh new block.  It should be set to  */
  /*               NULL if `size' is 0, or in case of error.               */
  /*                                                                       */
  /* <Return>                                                              */
  /*    FreeType error code.  0 means success.                             */
  /*                                                                       */
  /* <Note>                                                                */
  /*    All callers of ft_mem_realloc() _must_ provide the current block   */
  /*    size as well as the new one.                                       */
  /*                                                                       */
  FT_BASE( FT_Error )
  ft_mem_realloc( FT_Memory  memory,
                  FT_Long    current,
                  FT_Long    size,
                  void*     *P );


  /*************************************************************************/
  /*                                                                       */
  /* <Function>                                                            */
  /*    ft_mem_qrealloc                                                    */
  /*                                                                       */
  /* <Description>                                                         */
  /*    Reallocates a block of memory pointed to by `*P' to `Size' bytes   */
  /*    from the heap, possibly changing `*P'.  The returned area is *not* */
  /*    zero-filled, making reallocation quicker.                          */
  /*                                                                       */
  /* <Input>                                                               */
  /*    memory  :: A handle to a given `memory object' which handles       */
  /*               reallocation.                                           */
  /*                                                                       */
  /*    current :: The current block size in bytes.                        */
  /*                                                                       */
  /*    size    :: The new block size in bytes.                            */
  /*                                                                       */
  /* <InOut>                                                               */
  /*    P       :: A pointer to the fresh new block.  It should be set to  */
  /*               NULL if `size' is 0, or in case of error.               */
  /*                                                                       */
  /* <Return>                                                              */
  /*    FreeType error code.  0 means success.                             */
  /*                                                                       */
  /* <Note>                                                                */
  /*    All callers of ft_mem_realloc() _must_ provide the current block   */
  /*    size as well as the new one.                                       */
  /*                                                                       */
  FT_BASE( FT_Error )
  ft_mem_qrealloc( FT_Memory  memory,
                   FT_Long    current,
                   FT_Long    size,
                   void*     *p );


  /*************************************************************************/
  /*                                                                       */
  /* <Function>                                                            */
  /*    ft_mem_free                                                        */
  /*                                                                       */
  /* <Description>                                                         */
  /*    Releases a given block of memory allocated through ft_mem_alloc(). */
  /*                                                                       */
  /* <Input>                                                               */
  /*    memory :: A handle to a given `memory object' which handles        */
  /*              memory deallocation                                      */
  /*                                                                       */
  /*    P      :: This is the _address_ of a _pointer_ which points to the */
  /*              allocated block.  It is always set to NULL on exit.      */
  /*                                                                       */
  /* <Note>                                                                */
  /*    If P or *P is NULL, this function should return successfully.      */
  /*    This is a strong convention within all of FreeType and its         */
  /*    drivers.                                                           */
  /*                                                                       */
  FT_BASE( void )
  ft_mem_free( FT_Memory  memory,
               void*     *P );


#ifdef FT_DEBUG_MEMORY


#define FT_MEM_ALLOC( _pointer_, _size_ )                  \
          ft_mem_alloc_debug( memory, _size_,              \
                              (void**)(void*)&(_pointer_), \
                              __FILE__, __LINE__ )

#define FT_MEM_REALLOC( _pointer_, _current_, _size_ )       \
          ft_mem_realloc_debug( memory, _current_, _size_,   \
                                (void**)(void*)&(_pointer_), \
                                __FILE__, __LINE__ )

#define FT_MEM_QALLOC( _pointer_, _size_ )                  \
          ft_mem_qalloc_debug( memory, _size_,              \
                               (void**)(void*)&(_pointer_), \
                               __FILE__, __LINE__ )

#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ )       \
          ft_mem_qrealloc_debug( memory, _current_, _size_,   \
                                 (void**)(void*)&(_pointer_), \
                                 __FILE__, __LINE__ )

#define FT_MEM_FREE( _pointer_ )                                  \
          ft_mem_free_debug( memory, (void**)(void*)&(_pointer_), \
                             __FILE__, __LINE__ )


#else /* !FT_DEBUG_MEMORY */


#define FT_MEM_ALLOC( _pointer_, _size_ )             \
          ft_mem_alloc( memory, _size_,               \
                        (void**)(void*)&(_pointer_) )

#define FT_MEM_FREE( _pointer_ )                     \
          ft_mem_free( memory,                       \
                       (void**)(void*)&(_pointer_) )

#define FT_MEM_REALLOC( _pointer_, _current_, _size_ )  \
          ft_mem_realloc( memory, _current_, _size_,    \
                          (void**)(void*)&(_pointer_) )

#define FT_MEM_QALLOC( _pointer_, _size_ )             \
          ft_mem_qalloc( memory, _size_,               \
                         (void**)(void*)&(_pointer_) )

#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ )  \
          ft_mem_qrealloc( memory, _current_, _size_,    \
                           (void**)(void*)&(_pointer_) )


#endif /* !FT_DEBUG_MEMORY */


#define FT_MEM_REALLOC( ptr, cursz, newsz )                        \
          FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, 1,        \
                                                 (cursz), (newsz), \
                                                 (ptr), &error ) )

#define FT_MEM_QALLOC( ptr, size )                                          \
          FT_ASSIGNP_INNER( ptr, ft_mem_qalloc( memory, (size), &error ) )

#define FT_MEM_QNEW( ptr )                        \
          FT_MEM_QALLOC( ptr, sizeof ( *(ptr) ) )

#define FT_MEM_QREALLOC( ptr, cursz, newsz )                         \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, 1,        \
                                                  (cursz), (newsz), \
                                                  (ptr), &error ) )

#define FT_MEM_QRENEW_ARRAY( ptr, cursz, newsz )                              \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
                                                  (cursz), (newsz),          \
                                                  (ptr), &error ) )

#define FT_MEM_ALLOC_MULT( ptr, count, item_size )                     \
          FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, (item_size), \
                                                 0, (count),          \
                                                 NULL, &error ) )

#define FT_MEM_REALLOC_MULT( ptr, oldcnt, newcnt, itmsz )             \
          FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, (itmsz),    \
                                                 (oldcnt), (newcnt), \
                                                 (ptr), &error ) )

#define FT_MEM_QALLOC_MULT( ptr, count, item_size )                     \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, (item_size), \
                                                  0, (count),          \
                                                  NULL, &error ) )

#define FT_MEM_QREALLOC_MULT( ptr, oldcnt, newcnt, itmsz)             \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, (itmsz),    \
                                                  (oldcnt), (newcnt), \
                                                  (ptr), &error ) )


#define FT_MEM_SET_ERROR( cond )  ( (cond), error != 0 )


#define FT_MEM_SET( dest, byte, count )     ft_memset( dest, byte, count )

  /* _typed_ in order to automatically compute array element sizes.        */
  /*                                                                       */

#define FT_MEM_NEW_ARRAY( ptr, count )                                       \
          FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, sizeof ( *(ptr) ), \
                                                 0, (count),                \
                                                 NULL, &error ) )
          FT_MEM_ALLOC( _pointer_, (_count_) * sizeof ( *(_pointer_) ) )

#define FT_MEM_RENEW_ARRAY( _pointer_, _old_, _new_ )                    \
          FT_MEM_REALLOC( _pointer_, (_old_) * sizeof ( *(_pointer_) ),  \
                                     (_new_) * sizeof ( *(_pointer_) ) )

#define FT_MEM_QNEW( _pointer_ )                              \
          FT_MEM_QALLOC( _pointer_, sizeof ( *(_pointer_) ) )

#define FT_MEM_QNEW_ARRAY( _pointer_, _count_ )                           \
          FT_MEM_QALLOC( _pointer_, (_count_) * sizeof ( *(_pointer_) ) )

#define FT_MEM_QRENEW_ARRAY( _pointer_, _old_, _new_ )                    \
          FT_MEM_QREALLOC( _pointer_, (_old_) * sizeof ( *(_pointer_) ),  \
                                      (_new_) * sizeof ( *(_pointer_) ) )


  /*************************************************************************/
  /*                                                                       */
  /* the following macros are obsolete but kept for compatibility reasons  */
  /*                                                                       */

#define FT_MEM_ALLOC_ARRAY( _pointer_, _count_, _type_ )           \
          FT_MEM_ALLOC( _pointer_, (_count_) * sizeof ( _type_ ) )

#define FT_MEM_RENEW_ARRAY( ptr, cursz, newsz )                              \
          FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, sizeof ( *(ptr) ), \
                                                 (cursz), (newsz),          \
                                                 (ptr), &error ) )

#define FT_MEM_QNEW_ARRAY( ptr, count )                                       \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
                                                  0, (count),                \
                                                  NULL, &error ) )

#define FT_MEM_QRENEW_ARRAY( ptr, cursz, newsz )                              \
          FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
                                                  (cursz), (newsz),          \
                                                  (ptr), &error ) )
  /* if an error occured (i.e., if `error != 0').                          */
  /*                                                                       */

#define FT_ALLOC( _pointer_, _size_ )                           \
          FT_MEM_SET_ERROR( FT_MEM_ALLOC( _pointer_, _size_ ) )

#define FT_ALLOC( ptr, size )                           \
          FT_MEM_SET_ERROR( FT_MEM_ALLOC( ptr, size ) )

#define FT_REALLOC( ptr, cursz, newsz )                           \
          FT_MEM_SET_ERROR( FT_MEM_REALLOC( ptr, cursz, newsz ) )

#define FT_ALLOC_MULT( ptr, count, item_size )                           \
          FT_MEM_SET_ERROR( FT_MEM_ALLOC_MULT( ptr, count, item_size ) )

#define FT_REALLOC_MULT( ptr, oldcnt, newcnt, itmsz )              \
          FT_MEM_SET_ERROR( FT_MEM_REALLOC_MULT( ptr, oldcnt,      \
                                                 newcnt, itmsz ) )

#define FT_QALLOC( ptr, size )                           \
          FT_MEM_SET_ERROR( FT_MEM_QALLOC( ptr, size ) )

#define FT_QREALLOC( ptr, cursz, newsz )                           \
          FT_MEM_SET_ERROR( FT_MEM_QREALLOC( ptr, cursz, newsz ) )

#define FT_QALLOC_MULT( ptr, count, item_size )                           \
          FT_MEM_SET_ERROR( FT_MEM_QALLOC_MULT( ptr, count, item_size ) )

#define FT_QREALLOC_MULT( ptr, oldcnt, newcnt, itmsz )              \
          FT_MEM_SET_ERROR( FT_MEM_QREALLOC_MULT( ptr, oldcnt,      \
                                                  newcnt, itmsz ) )

#define FT_FREE( ptr )  FT_MEM_FREE( ptr )
          FT_REALLOC( _pointer_, sizeof ( *(_pointer_) ) * (_old_),  \
                                 sizeof ( *(_pointer_) ) * (_new_) )

#define FT_NEW( ptr )  FT_MEM_SET_ERROR( FT_MEM_NEW( ptr ) )
          FT_QALLOC( _pointer_, sizeof ( *(_pointer_) ) )

#define FT_NEW_ARRAY( ptr, count )                           \
          FT_MEM_SET_ERROR( FT_MEM_NEW_ARRAY( ptr, count ) )

#define FT_RENEW_ARRAY( ptr, curcnt, newcnt )                           \
          FT_MEM_SET_ERROR( FT_MEM_RENEW_ARRAY( ptr, curcnt, newcnt ) )
                                  sizeof ( *(_pointer_) ) * (_new_) )

#define FT_QNEW( ptr )                           \
          FT_MEM_SET_ERROR( FT_MEM_QNEW( ptr ) )

#define FT_QNEW_ARRAY( ptr, count )                          \
          FT_MEM_SET_ERROR( FT_MEM_NEW_ARRAY( ptr, count ) )

#define FT_QRENEW_ARRAY( ptr, curcnt, newcnt )                          \
          FT_MEM_SET_ERROR( FT_MEM_RENEW_ARRAY( ptr, curcnt, newcnt ) )
                                 (_new_) * sizeof ( _type_ ) )


#ifdef FT_CONFIG_OPTION_OLD_INTERNALS




          FT_SET_ERROR( FT_Stream_ReadFields( stream, fields, object ) )


#define FT_FRAME_ENTER( size )                                       \
          FT_SET_ERROR(                                              \
            FT_DEBUG_INNER( FT_Stream_EnterFrame( stream, size ) ) )

#define FT_FRAME_EXIT()                 \
          FT_DEBUG_INNER( FT_Stream_ExitFrame( stream ) )

#define FT_FRAME_EXTRACT( size, bytes )                                       \
          FT_SET_ERROR(                                                       \
            FT_DEBUG_INNER( FT_Stream_ExtractFrame( stream, size,             \
                                                    (FT_Byte**)&(bytes) ) ) )

#define FT_FRAME_RELEASE( bytes )                                         \
          FT_DEBUG_INNER( FT_Stream_ReleaseFrame( stream,                 \
                                                  (FT_Byte**)&(bytes) ) )


FT_END_HEADER

Lines 165-171 Link Here

(-)a/src/base/ftbitmap.c (-1 / +1 lines)
165		165
166	new_pitch = ( bitmap->width + xpixels + ppb - 1 ) / ppb;	166	new_pitch = ( bitmap->width + xpixels + ppb - 1 ) / ppb;
167		167
168	if ( FT_ALLOC( buffer, new_pitch * ( bitmap->rows + ypixels ) ) )	168	if ( FT_QALLOC_MULT( buffer, new_pitch, bitmap->rows + ypixels ) )
169	return error;	169	return error;
170		170
171	if ( bitmap->pitch > 0 )	171	if ( bitmap->pitch > 0 )

Lines 36-41 Link Here

(-)a/src/base/ftdbgmem.c (-238 / +40 lines)
36	#include <stdio.h>	36	#include <stdio.h>
37	#include <stdlib.h>	37	#include <stdlib.h>
38		38
		39	FT_BASE_DEF( const char* ) _ft_debug_file = 0;
		40	FT_BASE_DEF( long ) _ft_debug_lineno = 0;
39		41
40	extern void	42	extern void
41	FT_DumpMemory( FT_Memory memory );	43	FT_DumpMemory( FT_Memory memory );
Lines 48-54 Link Here
48		50
49	#define FT_MEM_VAL( addr ) ((FT_ULong)(FT_Pointer)( addr ))	51	#define FT_MEM_VAL( addr ) ((FT_ULong)(FT_Pointer)( addr ))
50		52
51		53	/*
		54	* This structure holds statistics for a single allocation/release
		55	* site. This is useful to know where memory operations happen the
		56	* most.
		57	*/
52	typedef struct FT_MemSourceRec_	58	typedef struct FT_MemSourceRec_
53	{	59	{
54	const char* file_name;	60	const char* file_name;
Lines 76-82 Link Here
76	*/	82	*/
77	#define FT_MEM_SOURCE_BUCKETS 128	83	#define FT_MEM_SOURCE_BUCKETS 128
78		84
79		85	/*
		86	* This structure holds information related to a single allocated
		87	* memory block. If KEEPALIVE is defined, blocks that are freed by
		88	* FreeType are never released to the system. Instead, their `size'
		89	* field is set to -size. This is mainly useful to detect double frees,
		90	* at the price of large memory footprint during execution.
		91	*/
80	typedef struct FT_MemNodeRec_	92	typedef struct FT_MemNodeRec_
81	{	93	{
82	FT_Byte* address;	94	FT_Byte* address;
Lines 94-99 Link Here
94	} FT_MemNodeRec;	106	} FT_MemNodeRec;
95		107
96		108
		109	/*
		110	* The global structure, containing compound statistics and all hash
		111	* tables.
		112	*/
97	typedef struct FT_MemTableRec_	113	typedef struct FT_MemTableRec_
98	{	114	{
99	FT_ULong size;	115	FT_ULong size;
Lines 113-121 Link Here
113		129
114	FT_MemSource sources[FT_MEM_SOURCE_BUCKETS];	130	FT_MemSource sources[FT_MEM_SOURCE_BUCKETS];
115		131
116	const char* file_name;
117	FT_Long line_no;
118
119	FT_Bool keep_alive;	132	FT_Bool keep_alive;
120		133
121	FT_Memory memory;	134	FT_Memory memory;
Lines 447-454 Link Here
447	FT_MemSource node, *pnode;	460	FT_MemSource node, *pnode;
448		461
449		462
450	hash = (FT_UInt32)(void*)table->file_name +	463	hash = (FT_UInt32)(void*)_ft_debug_file +
451	(FT_UInt32)( 5 * table->line_no );	464	(FT_UInt32)( 5 * _ft_debug_lineno );
452	pnode = &table->sources[hash % FT_MEM_SOURCE_BUCKETS];	465	pnode = &table->sources[hash % FT_MEM_SOURCE_BUCKETS];
453		466
454	for ( ;; )	467	for ( ;; )
Lines 457-464 Link Here
457	if ( node == NULL )	470	if ( node == NULL )
458	break;	471	break;
459		472
460	if ( node->file_name == table->file_name &&	473	if ( node->file_name == _ft_debug_file &&
461	node->line_no == table->line_no )	474	node->line_no == _ft_debug_lineno )
462	goto Exit;	475	goto Exit;
463		476
464	pnode = &node->link;	477	pnode = &node->link;
Lines 469-476 Link Here
469	ft_mem_debug_panic(	482	ft_mem_debug_panic(
470	"not enough memory to perform memory debugging\n" );	483	"not enough memory to perform memory debugging\n" );
471		484
472	node->file_name = table->file_name;	485	node->file_name = _ft_debug_file;
473	node->line_no = table->line_no;	486	node->line_no = _ft_debug_lineno;
474		487
475	node->cur_blocks = 0;	488	node->cur_blocks = 0;
476	node->max_blocks = 0;	489	node->max_blocks = 0;
Lines 527-533 Link Here
527	"org=%s:%d new=%s:%d\n",	540	"org=%s:%d new=%s:%d\n",
528	node->address, node->size,	541	node->address, node->size,
529	FT_FILENAME( node->source->file_name ), node->source->line_no,	542	FT_FILENAME( node->source->file_name ), node->source->line_no,
530	FT_FILENAME( table->file_name ), table->line_no );	543	FT_FILENAME( _ft_debug_file ), _ft_debug_lineno );
531	}	544	}
532	}	545	}
533		546
Lines 612-618 Link Here
612	"freeing memory block at %p more than once at (%s:%ld)\n"	625	"freeing memory block at %p more than once at (%s:%ld)\n"
613	"block allocated at (%s:%ld) and released at (%s:%ld)",	626	"block allocated at (%s:%ld) and released at (%s:%ld)",
614	address,	627	address,
615	FT_FILENAME( table->file_name ), table->line_no,	628	FT_FILENAME( _ft_debug_file ), _ft_debug_lineno,
616	FT_FILENAME( node->source->file_name ), node->source->line_no,	629	FT_FILENAME( node->source->file_name ), node->source->line_no,
617	FT_FILENAME( node->free_file_name ), node->free_line_no );	630	FT_FILENAME( node->free_file_name ), node->free_line_no );
618		631
Lines 634-641 Link Here
634	/* we simply invert the node's size to indicate that the node */	647	/* we simply invert the node's size to indicate that the node */
635	/* was freed. */	648	/* was freed. */
636	node->size = -node->size;	649	node->size = -node->size;
637	node->free_file_name = table->file_name;	650	node->free_file_name = _ft_debug_file;
638	node->free_line_no = table->line_no;	651	node->free_line_no = _ft_debug_lineno;
639	}	652	}
640	else	653	else
641	{	654	{
Lines 657-663 Link Here
657	ft_mem_debug_panic(	670	ft_mem_debug_panic(
658	"trying to free unknown block at %p in (%s:%ld)\n",	671	"trying to free unknown block at %p in (%s:%ld)\n",
659	address,	672	address,
660	FT_FILENAME( table->file_name ), table->line_no );	673	FT_FILENAME( _ft_debug_file ), _ft_debug_lineno );
661	}	674	}
662	}	675	}
663		676
Lines 680-686 Link Here
680		693
681	/* return NULL if this allocation would overflow the maximum heap size */	694	/* return NULL if this allocation would overflow the maximum heap size */
682	if ( table->bound_total &&	695	if ( table->bound_total &&
683	table->alloc_current + (FT_ULong)size > table->alloc_total_max )	696	table->alloc_total_max - table->alloc_current > (FT_ULong)size )
684	return NULL;	697	return NULL;
685		698
686	block = (FT_Byte *)ft_mem_table_alloc( table, size );	699	block = (FT_Byte *)ft_mem_table_alloc( table, size );
Lines 691-698 Link Here
691	table->alloc_count++;	704	table->alloc_count++;
692	}	705	}
693		706
694	table->file_name = NULL;	707	_ft_debug_file = "<unknown>";
695	table->line_no = 0;	708	_ft_debug_lineno = 0;
696		709
697	return (FT_Pointer)block;	710	return (FT_Pointer)block;
698	}	711	}
Lines 707-714 Link Here
707		720
708	if ( block == NULL )	721	if ( block == NULL )
709	ft_mem_debug_panic( "trying to free NULL in (%s:%ld)",	722	ft_mem_debug_panic( "trying to free NULL in (%s:%ld)",
710	FT_FILENAME( table->file_name ),	723	FT_FILENAME( _ft_debug_file ),
711	table->line_no );	724	_ft_debug_lineno );
712		725
713	ft_mem_table_remove( table, (FT_Byte*)block, 0 );	726	ft_mem_table_remove( table, (FT_Byte*)block, 0 );
714		727
Lines 717-724 Link Here
717		730
718	table->alloc_count--;	731	table->alloc_count--;
719		732
720	table->file_name = NULL;	733	_ft_debug_file = "<unknown>";
721	table->line_no = 0;	734	_ft_debug_lineno = 0;
722	}	735	}
723		736
724		737
Lines 733-740 Link Here
733	FT_Pointer new_block;	746	FT_Pointer new_block;
734	FT_Long delta;	747	FT_Long delta;
735		748
736	const char* file_name = FT_FILENAME( table->file_name );	749	const char* file_name = FT_FILENAME( _ft_debug_file );
737	FT_Long line_no = table->line_no;	750	FT_Long line_no = _ft_debug_lineno;
738		751
739		752
740	/* unlikely, but possible */	753	/* unlikely, but possible */
Lines 796-803 Link Here
796		809
797	ft_mem_table_remove( table, (FT_Byte*)block, delta );	810	ft_mem_table_remove( table, (FT_Byte*)block, delta );
798		811
799	table->file_name = NULL;	812	_ft_debug_file = "<unknown>";
800	table->line_no = 0;	813	_ft_debug_lineno = 0;
801		814
802	if ( !table->keep_alive )	815	if ( !table->keep_alive )
803	ft_mem_table_free( table, block );	816	ft_mem_table_free( table, block );
Lines 887-1103 Link Here
887	}	900	}
888		901
889		902
890	#ifdef FT_STRICT_ALIASING
891
892
893	FT_BASE_DEF( FT_Pointer )
894	ft_mem_alloc_debug( FT_Memory memory,
895	FT_Long size,
896	FT_Error *p_error,
897	const char* file_name,
898	FT_Long line_no )
899	{
900	FT_MemTable table = (FT_MemTable)memory->user;
901
902
903	if ( table )
904	{
905	table->file_name = file_name;
906	table->line_no = line_no;
907	}
908
909	return ft_mem_alloc( memory, size, p_error );
910	}
911
912
913	FT_BASE_DEF( FT_Pointer )
914	ft_mem_realloc_debug( FT_Memory memory,
915	FT_Long current,
916	FT_Long size,
917	void* block,
918	FT_Error *p_error,
919	const char* file_name,
920	FT_Long line_no )
921	{
922	FT_MemTable table = (FT_MemTable)memory->user;
923
924
925	if ( table )
926	{
927	table->file_name = file_name;
928	table->line_no = line_no;
929	}
930
931	return ft_mem_realloc( memory, current, size, block, p_error );
932	}
933
934
935	FT_BASE_DEF( FT_Pointer )
936	ft_mem_qalloc_debug( FT_Memory memory,
937	FT_Long size,
938	FT_Error *p_error,
939	const char* file_name,
940	FT_Long line_no )
941	{
942	FT_MemTable table = (FT_MemTable)memory->user;
943
944
945	if ( table )
946	{
947	table->file_name = file_name;
948	table->line_no = line_no;
949	}
950
951	return ft_mem_qalloc( memory, size, p_error );
952	}
953
954
955	FT_BASE_DEF( FT_Pointer )
956	ft_mem_qrealloc_debug( FT_Memory memory,
957	FT_Long current,
958	FT_Long size,
959	void* block,
960	FT_Error *p_error,
961	const char* file_name,
962	FT_Long line_no )
963	{
964	FT_MemTable table = (FT_MemTable)memory->user;
965
966
967	if ( table )
968	{
969	table->file_name = file_name;
970	table->line_no = line_no;
971	}
972
973	return ft_mem_qrealloc( memory, current, size, block, p_error );
974	}
975
976
977	FT_BASE_DEF( void )
978	ft_mem_free_debug( FT_Memory memory,
979	const void *P,
980	const char* file_name,
981	FT_Long line_no )
982	{
983	FT_MemTable table = (FT_MemTable)memory->user;
984
985
986	if ( table )
987	{
988	table->file_name = file_name;
989	table->line_no = line_no;
990	}
991
992	ft_mem_free( memory, (void *)P );
993	}
994
995
996	#else /* !FT_STRICT_ALIASING */
997
998
999	FT_BASE_DEF( FT_Error )
1000	ft_mem_alloc_debug( FT_Memory memory,
1001	FT_Long size,
1002	void* *P,
1003	const char* file_name,
1004	FT_Long line_no )
1005	{
1006	FT_MemTable table = (FT_MemTable)memory->user;
1007
1008
1009	if ( table )
1010	{
1011	table->file_name = file_name;
1012	table->line_no = line_no;
1013	}
1014
1015	return ft_mem_alloc( memory, size, P );
1016	}
1017
1018
1019	FT_BASE_DEF( FT_Error )
1020	ft_mem_realloc_debug( FT_Memory memory,
1021	FT_Long current,
1022	FT_Long size,
1023	void* *P,
1024	const char* file_name,
1025	FT_Long line_no )
1026	{
1027	FT_MemTable table = (FT_MemTable)memory->user;
1028
1029
1030	if ( table )
1031	{
1032	table->file_name = file_name;
1033	table->line_no = line_no;
1034	}
1035
1036	return ft_mem_realloc( memory, current, size, P );
1037	}
1038
1039
1040	FT_BASE_DEF( FT_Error )
1041	ft_mem_qalloc_debug( FT_Memory memory,
1042	FT_Long size,
1043	void* *P,
1044	const char* file_name,
1045	FT_Long line_no )
1046	{
1047	FT_MemTable table = (FT_MemTable)memory->user;
1048
1049
1050	if ( table )
1051	{
1052	table->file_name = file_name;
1053	table->line_no = line_no;
1054	}
1055
1056	return ft_mem_qalloc( memory, size, P );
1057	}
1058
1059
1060	FT_BASE_DEF( FT_Error )
1061	ft_mem_qrealloc_debug( FT_Memory memory,
1062	FT_Long current,
1063	FT_Long size,
1064	void* *P,
1065	const char* file_name,
1066	FT_Long line_no )
1067	{
1068	FT_MemTable table = (FT_MemTable)memory->user;
1069
1070
1071	if ( table )
1072	{
1073	table->file_name = file_name;
1074	table->line_no = line_no;
1075	}
1076
1077	return ft_mem_qrealloc( memory, current, size, P );
1078	}
1079
1080
1081	FT_BASE_DEF( void )
1082	ft_mem_free_debug( FT_Memory memory,
1083	FT_Pointer block,
1084	const char* file_name,
1085	FT_Long line_no )
1086	{
1087	FT_MemTable table = (FT_MemTable)memory->user;
1088
1089
1090	if ( table )
1091	{
1092	table->file_name = file_name;
1093	table->line_no = line_no;
1094	}
1095
1096	ft_mem_free( memory, (void **)block );
1097	}
1098
1099
1100	#endif /* !FT_STRICT_ALIASING */
1101		903
1102	static int	904	static int
1103	ft_mem_source_compare( const void* p1,	905	ft_mem_source_compare( const void* p1,




    short          res_id;
    unsigned char  *buffer, *p, *size_p = NULL;
    FT_ULong       total_size = 0;
    FT_ULong       old_total_size = 0;
    FT_ULong       post_size, pfb_chunk_size;
    Handle         post_data;
    char           code, last_code;


      total_size += GetHandleSize( post_data ) - 2;
      last_code = code;

      /* detect integer overflows */
      if ( total_size < old_total_size )
      {
        error = FT_Err_Array_Too_Large;
        goto Error;
      }

      old_total_size = total_size;
    }

    if ( FT_ALLOC( buffer, (FT_Long)total_size ) )




        if ( error )
          return error;

        if ( FT_NEW_ARRAY( offsets_internal, *count ) )
          return error;

        for ( j = 0; j < *count; ++j )

    FT_Error   error;
    char*      newpath;
    FT_Memory  memory;
    FT_Long    base_file_len = ft_strlen( base_file_name );

    FT_UNUSED( stream );


    memory = library->memory;

    if ( base_file_len > FT_INT_MAX )
      return FT_Err_Array_Too_Large;

    if ( FT_ALLOC( newpath, base_file_len + 6 ) )
      return error;

    FT_MEM_COPY( newpath, base_file_name, base_file_len );
    FT_MEM_COPY( newpath + base_file_len, "/rsrc", 6 );

    *result_file_name = newpath;
    *result_offset    = 0;

    return FT_Err_Ok;
  }


Lines 212-219 Link Here

(-)a/src/base/ftstream.c (-4 / +17 lines)
212	{	212	{
213	FT_Memory memory = stream->memory;	213	FT_Memory memory = stream->memory;
214		214
215		215	#ifdef FT_DEBUG_MEMORY
		216	ft_mem_free( memory, *pbytes );
		217	*pbytes = NULL;
		218	#else
216	FT_FREE( *pbytes );	219	FT_FREE( *pbytes );
		220	#endif
217	}	221	}
218	*pbytes = 0;	222	*pbytes = 0;
219	}	223	}
Lines 235-244 Link Here
235	/* allocate the frame in memory */	239	/* allocate the frame in memory */
236	FT_Memory memory = stream->memory;	240	FT_Memory memory = stream->memory;
237		241
238		242	#ifdef FT_DEBUG_MEMORY
		243	/* assume _ft_debug_file and _ft_debug_lineno are already set */
		244	stream->base = (unsigned char*)ft_mem_qalloc( memory, count, &error );
		245	if ( error )
		246	goto Exit;
		247	#else
239	if ( FT_QALLOC( stream->base, count ) )	248	if ( FT_QALLOC( stream->base, count ) )
240	goto Exit;	249	goto Exit;
241		250	#endif
242	/* read it */	251	/* read it */
243	read_bytes = stream->read( stream, stream->pos,	252	read_bytes = stream->read( stream, stream->pos,
244	stream->base, count );	253	stream->base, count );
Lines 298-305 Link Here
298	{	307	{
299	FT_Memory memory = stream->memory;	308	FT_Memory memory = stream->memory;
300		309
301		310	#ifdef FT_DEBUG_MEMORY
		311	ft_mem_free( memory, stream->base );
		312	stream->base = NULL;
		313	#else
302	FT_FREE( stream->base );	314	FT_FREE( stream->base );
		315	#endif
303	}	316	}
304	stream->cursor = 0;	317	stream->cursor = 0;
305	stream->limit = 0;	318	stream->limit = 0;




  /*************************************************************************/


#ifdef FT_STRICT_ALIASING


  FT_BASE_DEF( FT_Pointer )
  ft_mem_alloc( FT_Memory  memory,
                FT_Long    size,
                FT_Error  *p_error )
  {
    FT_Error    error;
    FT_Pointer  block = ft_mem_qalloc( memory, size, &error );

    if ( !error && size > 0 )
      FT_MEM_ZERO( block, size );
    {
      block = memory->alloc( memory, size );
      if ( block == NULL )
        error = FT_Err_Out_Of_Memory;
      else
        FT_MEM_ZERO( block, size );
    }
    else if ( size < 0 )
    {
      /* may help catch/prevent nasty security issues */
      error = FT_Err_Invalid_Argument;
    }

    *p_error = error;
    return block;


  FT_BASE_DEF( FT_Pointer )
  ft_mem_realloc( FT_Memory  memory,
                  FT_Long    item_size,
                  FT_Long    cur_count,
                  FT_Long    new_count,
                  void*      block,
                  FT_Error  *p_error )
  {
    FT_Error  error = FT_Err_Ok;

    block = ft_mem_qrealloc( memory, item_size,
                             cur_count, new_count, block, &error );
    if ( !error && new_count > cur_count )
      FT_MEM_ZERO( (char*)block + cur_count * item_size,
                   ( new_count - cur_count ) * item_size );
    }  
    else if ( size == 0 )
    {
      ft_mem_free( memory, block );
      block = NULL;
    }
    else if ( current == 0 )
    {
      FT_ASSERT( block == NULL );

      block = ft_mem_alloc( memory, size, &error );
    }
    else
    {
      FT_Pointer  block2;


      block2 = memory->realloc( memory, current, size, block );
      if ( block2 == NULL )
        error = FT_Err_Out_Of_Memory;
      else
      {
        block = block2;
        if ( size > current )
          FT_MEM_ZERO( (char*)block + current, size-current );
      }
    }

    *p_error = error;
    return block;


  FT_BASE_DEF( FT_Pointer )
  ft_mem_qrealloc( FT_Memory  memory,
                   FT_Long    item_size,
                   FT_Long    cur_count,
                   FT_Long    new_count,
                   void*      block,
                   FT_Error  *p_error )
  {
    FT_Error  error = FT_Err_Ok;


    if ( cur_count < 0 || new_count < 0 || item_size <= 0 )
    {
      /* may help catch/prevent nasty security issues */
      error = FT_Err_Invalid_Argument;
    }
    else if ( new_count == 0 )
    {
      ft_mem_free( memory, block );
      block = NULL;
    }
    else if ( new_count > FT_INT_MAX/item_size )
    {
      error = FT_Err_Array_Too_Large;
    }
    else if ( cur_count == 0 )
    {
      FT_ASSERT( block == NULL );

      block = ft_mem_alloc( memory, new_count*item_size, &error );
    }
    else
    {
      FT_Pointer  block2;
      FT_Long     cur_size = cur_count*item_size;
      FT_Long     new_size = new_count*item_size;


      block2 = memory->realloc( memory, cur_size, new_size, block );
      if ( block2 == NULL )
        error = FT_Err_Out_Of_Memory;
      else

  }


#else /* !FT_STRICT_ALIASING */


  /* documentation is in ftmemory.h */

  FT_BASE_DEF( FT_Error )
  ft_mem_alloc( FT_Memory  memory,
                FT_Long    size,
                void*     *P )
  { 
    FT_Error  error = FT_Err_Ok;
    

    FT_ASSERT( P != 0 );

    if ( size > 0 )
    {
      *P = memory->alloc( memory, size );
      if ( !*P )
      {
        FT_ERROR(( "ft_mem_alloc:" ));
        FT_ERROR(( " Out of memory? (%ld requested)\n",
                   size ));

        return FT_Err_Out_Of_Memory;
      }
      FT_MEM_ZERO( *P, size );
    }
    else
    {
      *P = NULL;
      if ( size < 0 )
        error = FT_Err_Invalid_Argument;
    }

    FT_TRACE7(( "ft_mem_alloc:" ));
    FT_TRACE7(( " size = %ld, block = 0x%08p, ref = 0x%08p\n",
                size, *P, P ));

    return error;
  }


  /* documentation is in ftmemory.h */

  FT_BASE_DEF( FT_Error )
  ft_mem_qalloc( FT_Memory  memory,
                 FT_Long    size,
                 void*     *P )
  {
    FT_Error  error = FT_Err_Ok;
    

    FT_ASSERT( P != 0 );

    if ( size > 0 )
    {
      *P = memory->alloc( memory, size );
      if ( !*P )
      {
        FT_ERROR(( "ft_mem_qalloc:" ));
        FT_ERROR(( " Out of memory? (%ld requested)\n",
                   size ));

        return FT_Err_Out_Of_Memory;
      }
    }
    else
    {
      *P = NULL;
      if ( size < 0 )
        error = FT_Err_Invalid_Argument;
    }

    FT_TRACE7(( "ft_mem_qalloc:" ));
    FT_TRACE7(( " size = %ld, block = 0x%08p, ref = 0x%08p\n",
                size, *P, P ));

    return error;
  }


  /* documentation is in ftmemory.h */

  FT_BASE_DEF( FT_Error )
  ft_mem_realloc( FT_Memory  memory,
                  FT_Long    current,
                  FT_Long    size,
                  void**     P )
  {
    void*  Q;


    FT_ASSERT( P != 0 );

    /* if the original pointer is NULL, call ft_mem_alloc() */
    if ( !*P )
      return ft_mem_alloc( memory, size, P );

    /* if the new block if zero-sized, clear the current one */
    if ( size == 0 )
    {
      ft_mem_free( memory, P );
      return FT_Err_Ok;
    }

    if ( size < 0 || current < 0 )
      return FT_Err_Invalid_Argument;

    Q = memory->realloc( memory, current, size, *P );
    if ( !Q )
      goto Fail;

    if ( size > current )
      FT_MEM_ZERO( (char*)Q + current, size - current );

    *P = Q;
    return FT_Err_Ok;

  Fail:
    FT_ERROR(( "ft_mem_realloc:" ));
    FT_ERROR(( " Failed (current %ld, requested %ld)\n",
               current, size ));
    return FT_Err_Out_Of_Memory;
  }


  /* documentation is in ftmemory.h */

  FT_BASE_DEF( FT_Error )
  ft_mem_qrealloc( FT_Memory  memory,
                   FT_Long    current,
                   FT_Long    size,
                   void**     P )
  {
    void*  Q;


    FT_ASSERT( P != 0 );

    /* if the original pointer is NULL, call ft_mem_qalloc() */
    if ( !*P )
      return ft_mem_qalloc( memory, size, P );

    /* if the new block if zero-sized, clear the current one */
    if ( size == 0 )
    {
      ft_mem_free( memory, P );
      return FT_Err_Ok;
    }

    if ( size < 0 || current < 0 )
      return FT_Err_Invalid_Argument;

    Q = memory->realloc( memory, current, size, *P );
    if ( !Q )
      goto Fail;

    *P = Q;
    return FT_Err_Ok;

  Fail:
    FT_ERROR(( "ft_mem_qrealloc:" ));
    FT_ERROR(( " Failed (current %ld, requested %ld)\n",
               current, size ));
    return FT_Err_Out_Of_Memory;
  }


  /* documentation is in ftmemory.h */

  FT_BASE_DEF( void )
  ft_mem_free( FT_Memory  memory,
               void*     *P )
  {
    FT_TRACE7(( "ft_mem_free:" ));
    FT_TRACE7(( " Freeing block 0x%08p ref 0x%08p\n", P, *P ));

    if ( P && *P )
    {
      memory->free( memory, *P );
      *P = NULL;
    }
  }

#endif /* !FT_STRICT_ALIASING */


  /*************************************************************************/
  /*************************************************************************/
  /*************************************************************************/

Lines 127-136 Link Here

(-)a/src/lzw/ftzopen.c (-4 / +2 lines)
127	* to write it literally.	127	* to write it literally.
128	*	128	*
129	*/	129	*/
130	if ( FT_REALLOC(	130	if ( FT_REALLOC_MULT( state->prefix, old_size, new_size,
131	state->prefix,	131	sizeof ( FT_UShort ) + sizeof ( FT_Byte ) ) )
132	old_size * (sizeof ( FT_UShort ) + sizeof ( FT_Byte ) ),
133	new_size * (sizeof ( FT_UShort ) + sizeof ( FT_Byte ) ) ) )
134	return -1;	132	return -1;
135		133
136	/* now adjust `suffix' and move the data accordingly */	134	/* now adjust `suffix' and move the data accordingly */

Lines 175-181 Link Here

(-)a/src/raster/ftrend1.c (-1 / +1 lines)
175	bitmap->rows = height;	175	bitmap->rows = height;
176	bitmap->pitch = pitch;	176	bitmap->pitch = pitch;
177		177
178	if ( FT_ALLOC( bitmap->buffer, (FT_ULong)pitch * height ) )	178	if ( FT_ALLOC_MULT( bitmap->buffer, pitch, height ) )
179	goto Exit;	179	goto Exit;
180		180
181	slot->internal->flags \|= FT_GLYPH_OWN_BITMAP;	181	slot->internal->flags \|= FT_GLYPH_OWN_BITMAP;

Lines 292-298 Link Here

(-)a/src/sfnt/ttpost.c (-1 / +1 lines)
292	goto Exit;	292	goto Exit;
293	}	293	}
294		294
295	if ( FT_ALLOC( offset_table, num_glyphs ) \|\|	295	if ( FT_NEW_ARRAY( offset_table, num_glyphs ) \|\|
296	FT_STREAM_READ( offset_table, num_glyphs ) )	296	FT_STREAM_READ( offset_table, num_glyphs ) )
297	goto Fail;	297	goto Fail;
298		298




        goto Exit;
      }

      if ( FT_NEW( face->blend ) )
        goto Exit;

      /* XXX: TODO - check for overflows */
      face->blend->mmvar_len =
        sizeof ( FT_MM_Var ) +
        fvar_head.axisCount * sizeof ( FT_Var_Axis ) +
        fvar_head.instanceCount * sizeof ( FT_Var_Named_Style ) +
        fvar_head.instanceCount * fvar_head.axisCount * sizeof ( FT_Fixed ) +
        5 * fvar_head.axisCount;

      if ( FT_ALLOC( mmvar, face->blend->mmvar_len ) )
        goto Exit;
      face->blend->mmvar = mmvar;

Lines 693-699 Link Here

(-)a/src/winfonts/winfnt.c (-1 / +1 lines)
693		697
694	/* note: since glyphs are stored in columns and not in rows we */	698	/* note: since glyphs are stored in columns and not in rows we */
695	/* can't use ft_glyphslot_set_bitmap */	699	/* can't use ft_glyphslot_set_bitmap */
696	if ( FT_ALLOC( bitmap->buffer, pitch * bitmap->rows ) )	700	if ( FT_ALLOC_MULT( bitmap->buffer, pitch, bitmap->rows ) )
697	goto Exit;	701	goto Exit;
698		702
699	column = (FT_Byte*)bitmap->buffer;	703	column = (FT_Byte*)bitmap->buffer;

Return to bug 124828

Lines 179-185 Link Here

(-)a/src/base/ftrfork.c (-6 / +11 lines)
179	if ( error )	179	if ( error )
180	return error;	180	return error;
181		181
182	if ( FT_ALLOC( offsets_internal, count sizeof( FT_Long ) ) )	182	if ( FT_NEW_ARRAY( offsets_internal, *count ) )
183	return error;	183	return error;
184		184
185	for ( j = 0; j < *count; ++j )	185	for ( j = 0; j < *count; ++j )
Lines 426-445 Link Here
426	FT_Error error;	426	FT_Error error;
427	char* newpath;	427	char* newpath;
428	FT_Memory memory;	428	FT_Memory memory;
		429	FT_Long base_file_len = ft_strlen( base_file_name );
429		430
430	FT_UNUSED( stream );	431	FT_UNUSED( stream );
431		432
432		433
433	memory = library->memory;	434	memory = library->memory;
434		435
435	if ( FT_ALLOC( newpath,	436	if ( base_file_len > FT_INT_MAX )
436	ft_strlen( base_file_name ) + ft_strlen( "/rsrc" ) + 1 ) )	437	return FT_Err_Array_Too_Large;
		438
		439	if ( FT_ALLOC( newpath, base_file_len + 6 ) )
437	return error;	440	return error;
438		441
439	ft_strcpy( newpath, base_file_name );	442	FT_MEM_COPY( newpath, base_file_name, base_file_len );
440	ft_strcat( newpath, "/rsrc" );	443	FT_MEM_COPY( newpath + base_file_len, "/rsrc", 6 );
		444
441	*result_file_name = newpath;	445	*result_file_name = newpath;
442	*result_offset = 0;	446	*result_offset = 0;
		447
443	return FT_Err_Ok;	448	return FT_Err_Ok;
444	}	449	}
445		450

Lines 57-63 FT_BEGIN_HEADER Link Here

(-)a/include/freetype/internal/ftmemory.h (-425 / +132 lines)
57	/*************************************************************************/	57	/*************************************************************************/
58		58
59		59
60	#ifdef FT_STRICT_ALIASING	60	/* C++ absolutely hates statements like p = (void*)anything; where 'p' is
		61	* a typed pointer. Since we don't have a typeof operator in standard C++,
		62	* we need some really ugly casts, like:
		63	*/
		64	#ifdef __cplusplus
		65	# define FT_ASSIGNP(p,val) ((void*)&(p)) = (val)
		66	#else
		67	# define FT_ASSIGNP(p,val) (p) = (val)
		68	#endif
		69
		70
		71
		72	#ifdef FT_DEBUG_MEMORY
		73
		74	FT_BASE( const char* ) _ft_debug_file;
		75	FT_BASE( long ) _ft_debug_lineno;
		76
		77	# define FT_DEBUG_INNER( exp ) ( _ft_debug_file = __FILE__, \
		78	_ft_debug_lineno = __LINE__, \
		79	(exp) )
		80
		81	# define FT_ASSIGNP_INNER( p, exp ) ( _ft_debug_file = __FILE__, \
		82	_ft_debug_lineno = __LINE__, \
		83	FT_ASSIGNP( p, exp ) )
		84
		85	#else /* !FT_DEBUG_MEMORY */
		86
		87	# define FT_DEBUG_INNER( exp ) (exp)
		88	# define FT_ASSIGNP_INNER( p, exp ) FT_ASSIGNP( p, exp )
		89
		90	#endif /* !FT_DEBUG_MEMORY */
61		91
62		92
63	/*	93	/*
Lines 78-92 FT_BEGIN_HEADER Link Here
78		108
79	FT_BASE( FT_Pointer )	109	FT_BASE( FT_Pointer )
80	ft_mem_realloc( FT_Memory memory,	110	ft_mem_realloc( FT_Memory memory,
81	FT_Long current,	111	FT_Long item_size,
82	FT_Long size,	112	FT_Long cur_count,
		113	FT_Long new_count,
83	void* block,	114	void* block,
84	FT_Error *p_error );	115	FT_Error *p_error );
85		116
86	FT_BASE( FT_Pointer )	117	FT_BASE( FT_Pointer )
87	ft_mem_qrealloc( FT_Memory memory,	118	ft_mem_qrealloc( FT_Memory memory,
88	FT_Long current,	119	FT_Long item_size,
89	FT_Long size,	120	FT_Long cur_count,
		121	FT_Long new_count,
90	void* block,	122	void* block,
91	FT_Error *p_error );	123	FT_Error *p_error );
92		124
Lines 95-460 FT_BEGIN_HEADER Link Here
95	const void* P );	127	const void* P );
96		128
97		129
98	#ifdef FT_DEBUG_MEMORY	130	#define FT_MEM_ALLOC( ptr, size ) \
99		131	FT_ASSIGNP_INNER( ptr, ft_mem_alloc( memory, (size), &error ) )
100
101	FT_BASE( FT_Pointer )
102	ft_mem_alloc_debug( FT_Memory memory,
103	FT_Long size,
104	FT_Error *p_error,
105	const char* file_name,
106	FT_Long line_no );
107
108	FT_BASE( FT_Pointer )
109	ft_mem_qalloc_debug( FT_Memory memory,
110	FT_Long size,
111	FT_Error *p_error,
112	const char* file_name,
113	FT_Long line_no );
114
115	FT_BASE( FT_Pointer )
116	ft_mem_realloc_debug( FT_Memory memory,
117	FT_Long current,
118	FT_Long size,
119	void* P,
120	FT_Error *p_error,
121	const char* file_name,
122	FT_Long line_no );
123
124	FT_BASE( FT_Pointer )
125	ft_mem_qrealloc_debug( FT_Memory memory,
126	FT_Long current,
127	FT_Long size,
128	void* P,
129	FT_Error *p_error,
130	const char* file_name,
131	FT_Long line_no );
132
133	FT_BASE( void )
134	ft_mem_free_debug( FT_Memory memory,
135	const void *P,
136	const char* file_name,
137	FT_Long line_no );
138
139
140	#define FT_MEM_ALLOC( _pointer_, _size_ ) \
141	(_pointer_) = ft_mem_alloc_debug( memory, _size_, &error, \
142	__FILE__, __LINE__ )
143
144	#define FT_MEM_REALLOC( _pointer_, _current_, _size_ ) \
145	(_pointer_) = ft_mem_realloc_debug( memory, _current_, _size_, \
146	(_pointer_), &error, \
147	__FILE__, __LINE__ )
148
149	#define FT_MEM_QALLOC( _pointer_, _size_ ) \
150	(_pointer_) = ft_mem_qalloc_debug( memory, _size_, &error, \
151	__FILE__, __LINE__ )
152
153	#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ ) \
154	(_pointer_) = ft_mem_qrealloc_debug( memory, _current_, _size_, \
155	(_pointer_), &error, \
156	__FILE__, __LINE__ )
157
158	#define FT_MEM_FREE( _pointer_ ) \
159	FT_BEGIN_STMNT \
160	if ( _pointer_ ) \
161	{ \
162	ft_mem_free_debug( memory, (_pointer_), __FILE__, __LINE__ ); \
163	(_pointer_) = NULL; \
164	} \
165	FT_END_STMNT
166
167
168	#else /* !FT_DEBUG_MEMORY */
169
170		132
171	#define FT_MEM_ALLOC( _pointer_, _size_ ) \	133	#define FT_MEM_FREE( ptr ) \
172	(_pointer_) = ft_mem_alloc( memory, _size_, &error )	134	FT_BEGIN_STMNT \
173		135	ft_mem_free( memory, (ptr) ); \
174	#define FT_MEM_FREE( _pointer_ ) \	136	(ptr) = NULL; \
175	FT_BEGIN_STMNT \
176	if ( (_pointer_) ) \
177	{ \
178	ft_mem_free( memory, (_pointer_) ); \
179	(_pointer_) = NULL; \
180	} \
181	FT_END_STMNT	137	FT_END_STMNT
182		138
183	#define FT_MEM_REALLOC( _pointer_, _current_, _size_ ) \	139	#define FT_MEM_NEW( ptr ) \
184	(_pointer_) = ft_mem_realloc( memory, _current_, _size_, \	140	FT_MEM_ALLOC( ptr, sizeof ( *(ptr) ) )
185	(_pointer_), &error )
186
187	#define FT_MEM_QALLOC( _pointer_, _size_ ) \
188	(_pointer_) = ft_mem_qalloc( memory, _size_, &error )
189
190	#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ ) \
191	(_pointer_) = ft_mem_qrealloc( memory, _current_, _size_, \
192	(_pointer_), &error )
193
194	#endif /* !FT_DEBUG_MEMORY */
195
196
197	#define FT_MEM_SET_ERROR( cond ) ( (cond), error != 0 )
198
199
200	#else /* !FT_STRICT_ALIASING */
201
202
203	#ifdef FT_DEBUG_MEMORY
204
205
206	FT_BASE( FT_Error )
207	ft_mem_alloc_debug( FT_Memory memory,
208	FT_Long size,
209	void* *P,
210	const char* file_name,
211	FT_Long line_no );
212
213	FT_BASE( FT_Error )
214	ft_mem_qalloc_debug( FT_Memory memory,
215	FT_Long size,
216	void* *P,
217	const char* file_name,
218	FT_Long line_no );
219
220	FT_BASE( FT_Error )
221	ft_mem_realloc_debug( FT_Memory memory,
222	FT_Long current,
223	FT_Long size,
224	void* *P,
225	const char* file_name,
226	FT_Long line_no );
227
228	FT_BASE( FT_Error )
229	ft_mem_qrealloc_debug( FT_Memory memory,
230	FT_Long current,
231	FT_Long size,
232	void* *P,
233	const char* file_name,
234	FT_Long line_no );
235
236	FT_BASE( void )
237	ft_mem_free_debug( FT_Memory memory,
238	FT_Pointer block,
239	const char* file_name,
240	FT_Long line_no );
241
242
243	#endif /* FT_DEBUG_MEMORY */
244
245
246	/*************************************************************************/
247	/* */
248	/* <Function> */
249	/* ft_mem_alloc */
250	/* */
251	/* <Description> */
252	/* Allocates a new block of memory. The returned area is always */
253	/* zero-filled; this is a strong convention in many FreeType parts. */
254	/* */
255	/* <Input> */
256	/* memory :: A handle to a given `memory object' which handles */
257	/* allocation. */
258	/* */
259	/* size :: The size in bytes of the block to allocate. */
260	/* */
261	/* <Output> */
262	/* P :: A pointer to the fresh new block. It should be set to */
263	/* NULL if `size' is 0, or in case of error. */
264	/* */
265	/* <Return> */
266	/* FreeType error code. 0 means success. */
267	/* */
268	FT_BASE( FT_Error )
269	ft_mem_alloc( FT_Memory memory,
270	FT_Long size,
271	void* *P );
272
273
274	/*************************************************************************/
275	/* */
276	/* <Function> */
277	/* ft_mem_qalloc */
278	/* */
279	/* <Description> */
280	/* Allocates a new block of memory. The returned area is not */
281	/* zero-filled, making allocation quicker. */
282	/* */
283	/* <Input> */
284	/* memory :: A handle to a given `memory object' which handles */
285	/* allocation. */
286	/* */
287	/* size :: The size in bytes of the block to allocate. */
288	/* */
289	/* <Output> */
290	/* P :: A pointer to the fresh new block. It should be set to */
291	/* NULL if `size' is 0, or in case of error. */
292	/* */
293	/* <Return> */
294	/* FreeType error code. 0 means success. */
295	/* */
296	FT_BASE( FT_Error )
297	ft_mem_qalloc( FT_Memory memory,
298	FT_Long size,
299	void* *p );
300
301
302	/*************************************************************************/
303	/* */
304	/* <Function> */
305	/* ft_mem_realloc */
306	/* */
307	/* <Description> */
308	/* Reallocates a block of memory pointed to by `P' to `Size' bytes /
309	/* from the heap, possibly changing `P'. The returned area is /
310	/* zero-filled. */
311	/* */
312	/* <Input> */
313	/* memory :: A handle to a given `memory object' which handles */
314	/* reallocation. */
315	/* */
316	/* current :: The current block size in bytes. */
317	/* */
318	/* size :: The new block size in bytes. */
319	/* */
320	/* <InOut> */
321	/* P :: A pointer to the fresh new block. It should be set to */
322	/* NULL if `size' is 0, or in case of error. */
323	/* */
324	/* <Return> */
325	/* FreeType error code. 0 means success. */
326	/* */
327	/* <Note> */
328	/* All callers of ft_mem_realloc() _must_ provide the current block */
329	/* size as well as the new one. */
330	/* */
331	FT_BASE( FT_Error )
332	ft_mem_realloc( FT_Memory memory,
333	FT_Long current,
334	FT_Long size,
335	void* *P );
336
337
338	/*************************************************************************/
339	/* */
340	/* <Function> */
341	/* ft_mem_qrealloc */
342	/* */
343	/* <Description> */
344	/* Reallocates a block of memory pointed to by `P' to `Size' bytes /
345	/* from the heap, possibly changing `P'. The returned area is not* */
346	/* zero-filled, making reallocation quicker. */
347	/* */
348	/* <Input> */
349	/* memory :: A handle to a given `memory object' which handles */
350	/* reallocation. */
351	/* */
352	/* current :: The current block size in bytes. */
353	/* */
354	/* size :: The new block size in bytes. */
355	/* */
356	/* <InOut> */
357	/* P :: A pointer to the fresh new block. It should be set to */
358	/* NULL if `size' is 0, or in case of error. */
359	/* */
360	/* <Return> */
361	/* FreeType error code. 0 means success. */
362	/* */
363	/* <Note> */
364	/* All callers of ft_mem_realloc() _must_ provide the current block */
365	/* size as well as the new one. */
366	/* */
367	FT_BASE( FT_Error )
368	ft_mem_qrealloc( FT_Memory memory,
369	FT_Long current,
370	FT_Long size,
371	void* *p );
372
373
374	/*************************************************************************/
375	/* */
376	/* <Function> */
377	/* ft_mem_free */
378	/* */
379	/* <Description> */
380	/* Releases a given block of memory allocated through ft_mem_alloc(). */
381	/* */
382	/* <Input> */
383	/* memory :: A handle to a given `memory object' which handles */
384	/* memory deallocation */
385	/* */
386	/* P :: This is the _address_ of a _pointer_ which points to the */
387	/* allocated block. It is always set to NULL on exit. */
388	/* */
389	/* <Note> */
390	/* If P or P is NULL, this function should return successfully. /
391	/* This is a strong convention within all of FreeType and its */
392	/* drivers. */
393	/* */
394	FT_BASE( void )
395	ft_mem_free( FT_Memory memory,
396	void* *P );
397
398
399	#ifdef FT_DEBUG_MEMORY
400
401
402	#define FT_MEM_ALLOC( _pointer_, _size_ ) \
403	ft_mem_alloc_debug( memory, _size_, \
404	(void*)(void)&(_pointer_), \
405	__FILE__, __LINE__ )
406
407	#define FT_MEM_REALLOC( _pointer_, _current_, _size_ ) \
408	ft_mem_realloc_debug( memory, _current_, _size_, \
409	(void*)(void)&(_pointer_), \
410	__FILE__, __LINE__ )
411
412	#define FT_MEM_QALLOC( _pointer_, _size_ ) \
413	ft_mem_qalloc_debug( memory, _size_, \
414	(void*)(void)&(_pointer_), \
415	__FILE__, __LINE__ )
416
417	#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ ) \
418	ft_mem_qrealloc_debug( memory, _current_, _size_, \
419	(void*)(void)&(_pointer_), \
420	__FILE__, __LINE__ )
421
422	#define FT_MEM_FREE( _pointer_ ) \
423	ft_mem_free_debug( memory, (void*)(void)&(_pointer_), \
424	__FILE__, __LINE__ )
425
426
427	#else /* !FT_DEBUG_MEMORY */
428
429
430	#define FT_MEM_ALLOC( _pointer_, _size_ ) \
431	ft_mem_alloc( memory, _size_, \
432	(void*)(void)&(_pointer_) )
433
434	#define FT_MEM_FREE( _pointer_ ) \
435	ft_mem_free( memory, \
436	(void*)(void)&(_pointer_) )
437
438	#define FT_MEM_REALLOC( _pointer_, _current_, _size_ ) \
439	ft_mem_realloc( memory, _current_, _size_, \
440	(void*)(void)&(_pointer_) )
441
442	#define FT_MEM_QALLOC( _pointer_, _size_ ) \
443	ft_mem_qalloc( memory, _size_, \
444	(void*)(void)&(_pointer_) )
445
446	#define FT_MEM_QREALLOC( _pointer_, _current_, _size_ ) \
447	ft_mem_qrealloc( memory, _current_, _size_, \
448	(void*)(void)&(_pointer_) )
449
450
451	#endif /* !FT_DEBUG_MEMORY */
452
453		141
454	#define FT_MEM_SET_ERROR( cond ) ( ( error = (cond) ) != 0 )	142	#define FT_MEM_REALLOC( ptr, cursz, newsz ) \
		143	FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, 1, \
		144	(cursz), (newsz), \
		145	(ptr), &error ) )
		146
		147	#define FT_MEM_QALLOC( ptr, size ) \
		148	FT_ASSIGNP_INNER( ptr, ft_mem_qalloc( memory, (size), &error ) )
		149
		150	#define FT_MEM_QNEW( ptr ) \
		151	FT_MEM_QALLOC( ptr, sizeof ( *(ptr) ) )
		152
		153	#define FT_MEM_QREALLOC( ptr, cursz, newsz ) \
		154	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, 1, \
		155	(cursz), (newsz), \
		156	(ptr), &error ) )
		157
		158	#define FT_MEM_QRENEW_ARRAY( ptr, cursz, newsz ) \
		159	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
		160	(cursz), (newsz), \
		161	(ptr), &error ) )
		162
		163	#define FT_MEM_ALLOC_MULT( ptr, count, item_size ) \
		164	FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, (item_size), \
		165	0, (count), \
		166	NULL, &error ) )
		167
		168	#define FT_MEM_REALLOC_MULT( ptr, oldcnt, newcnt, itmsz ) \
		169	FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, (itmsz), \
		170	(oldcnt), (newcnt), \
		171	(ptr), &error ) )
		172
		173	#define FT_MEM_QALLOC_MULT( ptr, count, item_size ) \
		174	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, (item_size), \
		175	0, (count), \
		176	NULL, &error ) )
		177
		178	#define FT_MEM_QREALLOC_MULT( ptr, oldcnt, newcnt, itmsz) \
		179	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, (itmsz), \
		180	(oldcnt), (newcnt), \
		181	(ptr), &error ) )
455		182
456		183
457	#endif /* !FT_STRICT_ALIASING */	184	#define FT_MEM_SET_ERROR( cond ) ( (cond), error != 0 )
458		185
459		186
460	#define FT_MEM_SET( dest, byte, count ) ft_memset( dest, byte, count )	187	#define FT_MEM_SET( dest, byte, count ) ft_memset( dest, byte, count )
Lines 494-584 FT_BEGIN_HEADER Link Here
494	/* _typed_ in order to automatically compute array element sizes. */	222	/* _typed_ in order to automatically compute array element sizes. */
495	/* */	223	/* */
496		224
497	#define FT_MEM_NEW( _pointer_ ) \	225	#define FT_MEM_NEW_ARRAY( ptr, count ) \
498	FT_MEM_ALLOC( _pointer_, sizeof ( *(_pointer_) ) )	226	FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, sizeof ( *(ptr) ), \
499		227	0, (count), \
500	#define FT_MEM_NEW_ARRAY( _pointer_, _count_ ) \	228	NULL, &error ) )
501	FT_MEM_ALLOC( _pointer_, (_count_) * sizeof ( *(_pointer_) ) )
502
503	#define FT_MEM_RENEW_ARRAY( _pointer_, _old_, _new_ ) \
504	FT_MEM_REALLOC( _pointer_, (_old_) * sizeof ( *(_pointer_) ), \
505	(_new_) * sizeof ( *(_pointer_) ) )
506
507	#define FT_MEM_QNEW( _pointer_ ) \
508	FT_MEM_QALLOC( _pointer_, sizeof ( *(_pointer_) ) )
509
510	#define FT_MEM_QNEW_ARRAY( _pointer_, _count_ ) \
511	FT_MEM_QALLOC( _pointer_, (_count_) * sizeof ( *(_pointer_) ) )
512
513	#define FT_MEM_QRENEW_ARRAY( _pointer_, _old_, _new_ ) \
514	FT_MEM_QREALLOC( _pointer_, (_old_) * sizeof ( *(_pointer_) ), \
515	(_new_) * sizeof ( *(_pointer_) ) )
516
517
518	/*************************************************************************/
519	/* */
520	/* the following macros are obsolete but kept for compatibility reasons */
521	/* */
522
523	#define FT_MEM_ALLOC_ARRAY( _pointer_, _count_, _type_ ) \
524	FT_MEM_ALLOC( _pointer_, (_count_) * sizeof ( _type_ ) )
525		229
526	#define FT_MEM_REALLOC_ARRAY( _pointer_, _old_, _new_, _type_ ) \	230	#define FT_MEM_RENEW_ARRAY( ptr, cursz, newsz ) \
527	FT_MEM_REALLOC( _pointer_, (_old_) * sizeof ( _type ), \	231	FT_ASSIGNP_INNER( ptr, ft_mem_realloc( memory, sizeof ( *(ptr) ), \
528	(_new_) * sizeof ( _type_ ) )	232	(cursz), (newsz), \
		233	(ptr), &error ) )
529		234
		235	#define FT_MEM_QNEW_ARRAY( ptr, count ) \
		236	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
		237	0, (count), \
		238	NULL, &error ) )
530		239
531	/*************************************************************************/	240	#define FT_MEM_QRENEW_ARRAY( ptr, cursz, newsz ) \
532	/* */	241	FT_ASSIGNP_INNER( ptr, ft_mem_qrealloc( memory, sizeof ( *(ptr) ), \
533	/* The following macros are variants of their FT_MEM_XXXX equivalents; */	242	(cursz), (newsz), \
534	/* they are used to set an _implicit_ `error' variable and return TRUE */	243	(ptr), &error ) )
535	/* if an error occured (i.e., if `error != 0'). */
536	/* */
537		244
538	#define FT_ALLOC( _pointer_, _size_ ) \
539	FT_MEM_SET_ERROR( FT_MEM_ALLOC( _pointer_, _size_ ) )
540		245
541	#define FT_REALLOC( _pointer_, _current_, _size_ ) \	246	#define FT_ALLOC( ptr, size ) \
542	FT_MEM_SET_ERROR( FT_MEM_REALLOC( _pointer_, _current_, _size_ ) )	247	FT_MEM_SET_ERROR( FT_MEM_ALLOC( ptr, size ) )
543		248
544	#define FT_QALLOC( _pointer_, _size_ ) \	249	#define FT_REALLOC( ptr, cursz, newsz ) \
545	FT_MEM_SET_ERROR( FT_MEM_QALLOC( _pointer_, _size_ ) )	250	FT_MEM_SET_ERROR( FT_MEM_REALLOC( ptr, cursz, newsz ) )
546		251
547	#define FT_QREALLOC( _pointer_, _current_, _size_ ) \	252	#define FT_ALLOC_MULT( ptr, count, item_size ) \
548	FT_MEM_SET_ERROR( FT_MEM_QREALLOC( _pointer_, _current_, _size_ ) )	253	FT_MEM_SET_ERROR( FT_MEM_ALLOC_MULT( ptr, count, item_size ) )
549		254
		255	#define FT_REALLOC_MULT( ptr, oldcnt, newcnt, itmsz ) \
		256	FT_MEM_SET_ERROR( FT_MEM_REALLOC_MULT( ptr, oldcnt, \
		257	newcnt, itmsz ) )
550		258
551	#define FT_FREE( _pointer_ ) \	259	#define FT_QALLOC( ptr, size ) \
552	FT_MEM_FREE( _pointer_ )	260	FT_MEM_SET_ERROR( FT_MEM_QALLOC( ptr, size ) )
553		261
		262	#define FT_QREALLOC( ptr, cursz, newsz ) \
		263	FT_MEM_SET_ERROR( FT_MEM_QREALLOC( ptr, cursz, newsz ) )
554		264
555	#define FT_NEW( _pointer_ ) \	265	#define FT_QALLOC_MULT( ptr, count, item_size ) \
556	FT_ALLOC( _pointer_, sizeof ( *(_pointer_) ) )	266	FT_MEM_SET_ERROR( FT_MEM_QALLOC_MULT( ptr, count, item_size ) )
557		267
558	#define FT_NEW_ARRAY( _pointer_, _count_ ) \	268	#define FT_QREALLOC_MULT( ptr, oldcnt, newcnt, itmsz ) \
559	FT_ALLOC( _pointer_, sizeof ( (_pointer_) ) (_count_) )	269	FT_MEM_SET_ERROR( FT_MEM_QREALLOC_MULT( ptr, oldcnt, \
		270	newcnt, itmsz ) )
560		271
561	#define FT_RENEW_ARRAY( _pointer_, _old_, _new_ ) \	272	#define FT_FREE( ptr ) FT_MEM_FREE( ptr )
562	FT_REALLOC( _pointer_, sizeof ( (_pointer_) ) (_old_), \
563	sizeof ( (_pointer_) ) (_new_) )
564		273
565	#define FT_QNEW( _pointer_ ) \	274	#define FT_NEW( ptr ) FT_MEM_SET_ERROR( FT_MEM_NEW( ptr ) )
566	FT_QALLOC( _pointer_, sizeof ( *(_pointer_) ) )
567		275
568	#define FT_QNEW_ARRAY( _pointer_, _count_ ) \	276	#define FT_NEW_ARRAY( ptr, count ) \
569	FT_QALLOC( _pointer_, sizeof ( (_pointer_) ) (_count_) )	277	FT_MEM_SET_ERROR( FT_MEM_NEW_ARRAY( ptr, count ) )
570		278
571	#define FT_QRENEW_ARRAY( _pointer_, _old_, _new_ ) \	279	#define FT_RENEW_ARRAY( ptr, curcnt, newcnt ) \
572	FT_QREALLOC( _pointer_, sizeof ( (_pointer_) ) (_old_), \	280	FT_MEM_SET_ERROR( FT_MEM_RENEW_ARRAY( ptr, curcnt, newcnt ) )
573	sizeof ( (_pointer_) ) (_new_) )
574		281
		282	#define FT_QNEW( ptr ) \
		283	FT_MEM_SET_ERROR( FT_MEM_QNEW( ptr ) )
575		284
576	#define FT_ALLOC_ARRAY( _pointer_, _count_, _type_ ) \	285	#define FT_QNEW_ARRAY( ptr, count ) \
577	FT_ALLOC( _pointer_, (_count_) * sizeof ( _type_ ) )	286	FT_MEM_SET_ERROR( FT_MEM_NEW_ARRAY( ptr, count ) )
578		287
579	#define FT_REALLOC_ARRAY( _pointer_, _old_, _new_, _type_ ) \	288	#define FT_QRENEW_ARRAY( ptr, curcnt, newcnt ) \
580	FT_REALLOC( _pointer_, (_old_) * sizeof ( _type_ ), \	289	FT_MEM_SET_ERROR( FT_MEM_RENEW_ARRAY( ptr, curcnt, newcnt ) )
581	(_new_) * sizeof ( _type_ ) )
582		290
583		291
584	#ifdef FT_CONFIG_OPTION_OLD_INTERNALS	292	#ifdef FT_CONFIG_OPTION_OLD_INTERNALS

Lines 514-531 FT_BEGIN_HEADER Link Here

(-)a/include/freetype/internal/ftstream.h (-9 / +12 lines)
514	FT_SET_ERROR( FT_Stream_ReadFields( stream, fields, object ) )	514	FT_SET_ERROR( FT_Stream_ReadFields( stream, fields, object ) )
515		515
516		516
517	#define FT_FRAME_ENTER( size ) \	517	#define FT_FRAME_ENTER( size ) \
518	FT_SET_ERROR( FT_Stream_EnterFrame( stream, size ) )	518	FT_SET_ERROR( \
		519	FT_DEBUG_INNER( FT_Stream_EnterFrame( stream, size ) ) )
519		520
520	#define FT_FRAME_EXIT() \	521	#define FT_FRAME_EXIT() \
521	FT_Stream_ExitFrame( stream )	522	FT_DEBUG_INNER( FT_Stream_ExitFrame( stream ) )
522		523
523	#define FT_FRAME_EXTRACT( size, bytes ) \	524	#define FT_FRAME_EXTRACT( size, bytes ) \
524	FT_SET_ERROR( FT_Stream_ExtractFrame( stream, size, \	525	FT_SET_ERROR( \
525	(FT_Byte**)&(bytes) ) )	526	FT_DEBUG_INNER( FT_Stream_ExtractFrame( stream, size, \
526		527	(FT_Byte**)&(bytes) ) ) )
527	#define FT_FRAME_RELEASE( bytes ) \	528
528	FT_Stream_ReleaseFrame( stream, (FT_Byte**)&(bytes) )	529	#define FT_FRAME_RELEASE( bytes ) \
		530	FT_DEBUG_INNER( FT_Stream_ReleaseFrame( stream, \
		531	(FT_Byte**)&(bytes) ) )
529		532
530		533
531	FT_END_HEADER	534	FT_END_HEADER

Lines 808-813 Link Here

(-)a/src/base/ftmac.c (+10 lines)
808	short res_id;	808	short res_id;
809	unsigned char buffer, p, *size_p = NULL;	809	unsigned char buffer, p, *size_p = NULL;
810	FT_ULong total_size = 0;	810	FT_ULong total_size = 0;
		811	FT_ULong old_total_size = 0;
811	FT_ULong post_size, pfb_chunk_size;	812	FT_ULong post_size, pfb_chunk_size;
812	Handle post_data;	813	Handle post_data;
813	char code, last_code;	814	char code, last_code;
Lines 838-843 Link Here
838		839
839	total_size += GetHandleSize( post_data ) - 2;	840	total_size += GetHandleSize( post_data ) - 2;
840	last_code = code;	841	last_code = code;
		842
		843	/* detect integer overflows */
		844	if ( total_size < old_total_size )
		845	{
		846	error = FT_Err_Array_Too_Large;
		847	goto Error;
		848	}
		849
		850	old_total_size = total_size;
841	}	851	}
842		852
843	if ( FT_ALLOC( buffer, (FT_Long)total_size ) )	853	if ( FT_ALLOC( buffer, (FT_Long)total_size ) )

Lines 46-76 Link Here

(-)a/src/base/ftutil.c (-248 / +26 lines)
46	/*************************************************************************/	46	/*************************************************************************/
47		47
48		48
49	#ifdef FT_STRICT_ALIASING
50
51
52	FT_BASE_DEF( FT_Pointer )	49	FT_BASE_DEF( FT_Pointer )
53	ft_mem_alloc( FT_Memory memory,	50	ft_mem_alloc( FT_Memory memory,
54	FT_Long size,	51	FT_Long size,
55	FT_Error *p_error )	52	FT_Error *p_error )
56	{	53	{
57	FT_Error error = FT_Err_Ok;	54	FT_Error error;
58	FT_Pointer block = NULL;	55	FT_Pointer block = ft_mem_qalloc( memory, size, &error );
59		56
60		57	if ( !error && size > 0 )
61	if ( size > 0 )	58	FT_MEM_ZERO( block, size );
62	{
63	block = memory->alloc( memory, size );
64	if ( block == NULL )
65	error = FT_Err_Out_Of_Memory;
66	else
67	FT_MEM_ZERO( block, size );
68	}
69	else if ( size < 0 )
70	{
71	/* may help catch/prevent nasty security issues */
72	error = FT_Err_Invalid_Argument;
73	}
74		59
75	*p_error = error;	60	*p_error = error;
76	return block;	61	return block;
Lines 105-149 Link Here
105		90
106	FT_BASE_DEF( FT_Pointer )	91	FT_BASE_DEF( FT_Pointer )
107	ft_mem_realloc( FT_Memory memory,	92	ft_mem_realloc( FT_Memory memory,
108	FT_Long current,	93	FT_Long item_size,
109	FT_Long size,	94	FT_Long cur_count,
		95	FT_Long new_count,
110	void* block,	96	void* block,
111	FT_Error *p_error )	97	FT_Error *p_error )
112	{	98	{
113	FT_Error error = FT_Err_Ok;	99	FT_Error error = FT_Err_Ok;
114		100
115		101	block = ft_mem_qrealloc( memory, item_size,
116	if ( size < 0 \|\| current < 0 )	102	cur_count, new_count, block, &error );
117	{	103	if ( !error && new_count > cur_count )
118	/* may help catch/prevent nasty security issues */	104	FT_MEM_ZERO( (char)block + cur_count item_size,
119	error = FT_Err_Invalid_Argument;	105	( new_count - cur_count ) * item_size );
120	}
121	else if ( size == 0 )
122	{
123	ft_mem_free( memory, block );
124	block = NULL;
125	}
126	else if ( current == 0 )
127	{
128	FT_ASSERT( block == NULL );
129
130	block = ft_mem_alloc( memory, size, &error );
131	}
132	else
133	{
134	FT_Pointer block2;
135
136
137	block2 = memory->realloc( memory, current, size, block );
138	if ( block2 == NULL )
139	error = FT_Err_Out_Of_Memory;
140	else
141	{
142	block = block2;
143	if ( size > current )
144	FT_MEM_ZERO( (char*)block + current, size-current );
145	}
146	}
147		106
148	*p_error = error;	107	*p_error = error;
149	return block;	108	return block;
Lines 152-187 Link Here
152		111
153	FT_BASE_DEF( FT_Pointer )	112	FT_BASE_DEF( FT_Pointer )
154	ft_mem_qrealloc( FT_Memory memory,	113	ft_mem_qrealloc( FT_Memory memory,
155	FT_Long current,	114	FT_Long item_size,
156	FT_Long size,	115	FT_Long cur_count,
		116	FT_Long new_count,
157	void* block,	117	void* block,
158	FT_Error *p_error )	118	FT_Error *p_error )
159	{	119	{
160	FT_Error error = FT_Err_Ok;	120	FT_Error error = FT_Err_Ok;
161		121
162		122
163	if ( size < 0 \|\| current < 0 )	123	if ( cur_count < 0 \|\| new_count < 0 \|\| item_size <= 0 )
164	{	124	{
165	/* may help catch/prevent nasty security issues */	125	/* may help catch/prevent nasty security issues */
166	error = FT_Err_Invalid_Argument;	126	error = FT_Err_Invalid_Argument;
167	}	127	}
168	else if ( size == 0 )	128	else if ( new_count == 0 )
169	{	129	{
170	ft_mem_free( memory, block );	130	ft_mem_free( memory, block );
171	block = NULL;	131	block = NULL;
172	}	132	}
173	else if ( current == 0 )	133	else if ( new_count > FT_INT_MAX/item_size )
		134	{
		135	error = FT_Err_Array_Too_Large;
		136	}
		137	else if ( cur_count == 0 )
174	{	138	{
175	FT_ASSERT( block == NULL );	139	FT_ASSERT( block == NULL );
176		140
177	block = ft_mem_qalloc( memory, size, &error );	141	block = ft_mem_alloc( memory, new_count*item_size, &error );
178	}	142	}
179	else	143	else
180	{	144	{
181	FT_Pointer block2;	145	FT_Pointer block2;
		146	FT_Long cur_size = cur_count*item_size;
		147	FT_Long new_size = new_count*item_size;
182		148
183		149
184	block2 = memory->realloc( memory, current, size, block );	150	block2 = memory->realloc( memory, cur_size, new_size, block );
185	if ( block2 == NULL )	151	if ( block2 == NULL )
186	error = FT_Err_Out_Of_Memory;	152	error = FT_Err_Out_Of_Memory;
187	else	153	else
Lines 202-395 Link Here
202	}	168	}
203		169
204		170
205	#else /* !FT_STRICT_ALIASING */
206
207
208	/* documentation is in ftmemory.h */
209
210	FT_BASE_DEF( FT_Error )
211	ft_mem_alloc( FT_Memory memory,
212	FT_Long size,
213	void* *P )
214	{
215	FT_Error error = FT_Err_Ok;
216
217
218	FT_ASSERT( P != 0 );
219
220	if ( size > 0 )
221	{
222	*P = memory->alloc( memory, size );
223	if ( !*P )
224	{
225	FT_ERROR(( "ft_mem_alloc:" ));
226	FT_ERROR(( " Out of memory? (%ld requested)\n",
227	size ));
228
229	return FT_Err_Out_Of_Memory;
230	}
231	FT_MEM_ZERO( *P, size );
232	}
233	else
234	{
235	*P = NULL;
236	if ( size < 0 )
237	error = FT_Err_Invalid_Argument;
238	}
239
240	FT_TRACE7(( "ft_mem_alloc:" ));
241	FT_TRACE7(( " size = %ld, block = 0x%08p, ref = 0x%08p\n",
242	size, *P, P ));
243
244	return error;
245	}
246
247
248	/* documentation is in ftmemory.h */
249
250	FT_BASE_DEF( FT_Error )
251	ft_mem_qalloc( FT_Memory memory,
252	FT_Long size,
253	void* *P )
254	{
255	FT_Error error = FT_Err_Ok;
256
257
258	FT_ASSERT( P != 0 );
259
260	if ( size > 0 )
261	{
262	*P = memory->alloc( memory, size );
263	if ( !*P )
264	{
265	FT_ERROR(( "ft_mem_qalloc:" ));
266	FT_ERROR(( " Out of memory? (%ld requested)\n",
267	size ));
268
269	return FT_Err_Out_Of_Memory;
270	}
271	}
272	else
273	{
274	*P = NULL;
275	if ( size < 0 )
276	error = FT_Err_Invalid_Argument;
277	}
278
279	FT_TRACE7(( "ft_mem_qalloc:" ));
280	FT_TRACE7(( " size = %ld, block = 0x%08p, ref = 0x%08p\n",
281	size, *P, P ));
282
283	return error;
284	}
285
286
287	/* documentation is in ftmemory.h */
288
289	FT_BASE_DEF( FT_Error )
290	ft_mem_realloc( FT_Memory memory,
291	FT_Long current,
292	FT_Long size,
293	void** P )
294	{
295	void* Q;
296
297
298	FT_ASSERT( P != 0 );
299
300	/* if the original pointer is NULL, call ft_mem_alloc() */
301	if ( !*P )
302	return ft_mem_alloc( memory, size, P );
303
304	/* if the new block if zero-sized, clear the current one */
305	if ( size == 0 )
306	{
307	ft_mem_free( memory, P );
308	return FT_Err_Ok;
309	}
310
311	if ( size < 0 \|\| current < 0 )
312	return FT_Err_Invalid_Argument;
313
314	Q = memory->realloc( memory, current, size, *P );
315	if ( !Q )
316	goto Fail;
317
318	if ( size > current )
319	FT_MEM_ZERO( (char*)Q + current, size - current );
320
321	*P = Q;
322	return FT_Err_Ok;
323
324	Fail:
325	FT_ERROR(( "ft_mem_realloc:" ));
326	FT_ERROR(( " Failed (current %ld, requested %ld)\n",
327	current, size ));
328	return FT_Err_Out_Of_Memory;
329	}
330
331
332	/* documentation is in ftmemory.h */
333
334	FT_BASE_DEF( FT_Error )
335	ft_mem_qrealloc( FT_Memory memory,
336	FT_Long current,
337	FT_Long size,
338	void** P )
339	{
340	void* Q;
341
342
343	FT_ASSERT( P != 0 );
344
345	/* if the original pointer is NULL, call ft_mem_qalloc() */
346	if ( !*P )
347	return ft_mem_qalloc( memory, size, P );
348
349	/* if the new block if zero-sized, clear the current one */
350	if ( size == 0 )
351	{
352	ft_mem_free( memory, P );
353	return FT_Err_Ok;
354	}
355
356	if ( size < 0 \|\| current < 0 )
357	return FT_Err_Invalid_Argument;
358
359	Q = memory->realloc( memory, current, size, *P );
360	if ( !Q )
361	goto Fail;
362
363	*P = Q;
364	return FT_Err_Ok;
365
366	Fail:
367	FT_ERROR(( "ft_mem_qrealloc:" ));
368	FT_ERROR(( " Failed (current %ld, requested %ld)\n",
369	current, size ));
370	return FT_Err_Out_Of_Memory;
371	}
372
373
374	/* documentation is in ftmemory.h */
375
376	FT_BASE_DEF( void )
377	ft_mem_free( FT_Memory memory,
378	void* *P )
379	{
380	FT_TRACE7(( "ft_mem_free:" ));
381	FT_TRACE7(( " Freeing block 0x%08p ref 0x%08p\n", P, *P ));
382
383	if ( P && *P )
384	{
385	memory->free( memory, *P );
386	*P = NULL;
387	}
388	}
389
390	#endif /* !FT_STRICT_ALIASING */
391
392
393	/*************************************************************************/	171	/*************************************************************************/
394	/*************************************************************************/	172	/*************************************************************************/
395	/*************************************************************************/	173	/*************************************************************************/

Lines 684-698 Link Here

(-)a/src/truetype/ttgxvar.c (-1 / +3 lines)
684	goto Exit;	684	goto Exit;
685	}	685	}
686		686
687	if ( FT_ALLOC( face->blend, sizeof ( GX_BlendRec ) ) )	687	if ( FT_NEW( face->blend ) )
688	goto Exit;	688	goto Exit;
689		689
		690	/* XXX: TODO - check for overflows */
690	face->blend->mmvar_len =	691	face->blend->mmvar_len =
691	sizeof ( FT_MM_Var ) +	692	sizeof ( FT_MM_Var ) +
692	fvar_head.axisCount * sizeof ( FT_Var_Axis ) +	693	fvar_head.axisCount * sizeof ( FT_Var_Axis ) +
693	fvar_head.instanceCount * sizeof ( FT_Var_Named_Style ) +	694	fvar_head.instanceCount * sizeof ( FT_Var_Named_Style ) +
694	fvar_head.instanceCount * fvar_head.axisCount * sizeof ( FT_Fixed ) +	695	fvar_head.instanceCount * fvar_head.axisCount * sizeof ( FT_Fixed ) +
695	5 * fvar_head.axisCount;	696	5 * fvar_head.axisCount;
		697
696	if ( FT_ALLOC( mmvar, face->blend->mmvar_len ) )	698	if ( FT_ALLOC( mmvar, face->blend->mmvar_len ) )
697	goto Exit;	699	goto Exit;
698	face->blend->mmvar = mmvar;	700	face->blend->mmvar = mmvar;