Problems with type1z and Subrs parsing

[Tom Kacvinsky]

Hi all,

I just found an error in the type1z module.

This all started with an investigation of why certain MM fonts (or
instances thereof) were failing.

I removed the type1 source tree from the full freetype2 tree and
modified include/free/config/ftmodule.h so that the type1z module and
not the type1 module were compiled into the library.  Probably a
simpler way of doing this; but I wanted to make sure that the type1z
and only the type1z parser got used.

The problem can be described thusly.

the function parse_subrs uses the loop

    for ( n = 0; n < loader->num_subrs; n++ )

where num_subrs is obtained from parsing /Subrs <some number> array.
The problem is that num_subrs can be an overestimate of the number
of subroutines actually defined.  In particular, dvips' old font
subsetter and Ed Kohler's mmpfb will leave out unused subroutines,
but make sure the number reported in /Subrs ... array is one more
than the highest subr. index used in any one charstring.

Now, we are going to parse past the end of the subrs data and into the
charstrings data and get a failure in read_binary_data.

Attached is *simple* patch that fixes this.  It was tested with some
of the problem fonts I had laying around.  Davis, it would be
interesting to see if this fixes the problems with some of the fonts
you have...

Regards,

Tom

z1load.diff
Description: Text document