[Devel] crash in FT_Get_CMap_Language_ID for synth Adobe charmaps

[Steve Hartwell]

Lately I've been getting a repeatable crash working with 
CourierStd.otf, an OpenType/CFF font distributed with Adobe Reader.

The problem is due to a mismatch in the class records for charmaps 
synthesized in cffobjs.c:cff_face_init() versus the ones used by 
ttcmap0.c:tt_face_build_cmaps().

-- cffobjs.c:cff_face_init() passes a class record pointer of type 
FT_CMap_Class (an FT_CMap_ClassRec *) to FT_CMap_New(), which matches 
its declaration.

-- ttcmap0.c:tt_face_build_cmaps() uses a class record of type 
TT_CMapRec_, pointer type TT_CMap_Class, and casts this pointer to an 
FT_CMap_Class when calling FT_CMap_New().

So when I call FT_Get_CMap_Language_ID(), it calls the TT_CMAP service 
tt_get_cmap_info() which casts the cmap->clazz to a TT_CMap_Class and 
calls a function pointer get_cmap_info().

However, synthesized cmaps created in cffobjs.c do not have the extra 
class info and function pointers, so when this is called, the program 
counter jumps to Vitoria, a coastal city just north of Rio de Janeiro 
:-)

I'm not quite sure where to suggest the change, but it would seem 
reasonable to avoid having to cast pointers to FT_CMap_New().  Perhaps 
unifying the FT_CMap_ClassRec and TT_CMapRec_ structures would help.  I 
realize that there are binary compatibility issues to consider, so 
another solution might be better.  Suggestions?

Steve Hartwell
http://stevehartwell.home.comcast.net/proj/fontinspector

p.s. in ttcmap0.c, it might be better to break out of the for ( ; 
*pclazz; pclazz++ ) loop once the formats match so that we don't keep 
looking for it after we've found it.