[Devel] bug in cffcmap.c

[Gordon Childs]

Hey all,
I've had freetype2.1.4 (and all versions through to 2.1.7) segfault 
when using
large subsetted fonts - I tracked the problem down to line 157 of 
cffcmap.c
(version 2.1.4) in the function cff_cmap_unicode_init:

157: count = (FT_UInt)face->root.num_glyphs;

should be

157: count = (FT_UInt)cff->num_glyphs;

the count used originally is the number of glyphs in the whole font, 
while what should be
used is the number of glyphs in this subset. count is subsequently used 
to index an array
of size cff->num_glyphs

169:         FT_UInt      sid = charset->sids[n];

charset->sids is allocated thus in several places in cffload.c - it 
uses the smaller number of glyphs.

      error = cff_charset_load( &font->charset, font->num_glyphs, 
stream,
                              base_offset, dict->charset_offset );

With the change mentioned above I've had no problems, and have stuck 
with 2.1.4

P.S. When searching for this bug, I tried several newer versions and 
found that parsing/loading
of some type1 fonts had been broken (control never returns), but that's 
another bug report.

Keep up the sterling work and thanks so much for what you've already 
done.

Regards,
Gordon.