Re: [ft-devel] Dynamic limits for TrueType bytecode execution

[Marek Kasik]

Hi,

On 09/27/2016 09:15 AM, Werner LEMBERG wrote:
> 
> From the CHANGES file:
> 
>     - Some limits for TrueType  bytecode execution have been tightened
>       to  speed   up  FreeType's  handling  of   malformed  fonts,  in
>       particular to quickly abort endless loops.
> 
>       - The  number of  twilight points  can no  longer be  set to  an
>         arbitrarily large value.
> 
>       - The total number of jump  opcode instructions (like JMPR) with
>         negative arguments  is dynamically restricted; the  same holds
>         for the total number of iterations in LOOPCALL opcodes.
> 
>       The dynamic limits are based on  the number of points in a glyph
>       and the number of CVT entries.  Please report if you encounter a
>       font where the selected values are not adequate.
> 
> So: Please test and report :-)

a problematic font was encountered by reporter of this downstream bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1456585.

The font there is Padauk-Bold.ttf (version 3.002 (it works with current
upstream)). It has exc->cvtSize == 35 so the exc->loopcall_counter_max
== 350 but exc->loopcall_counter == 523.

Do you consider this a problem of the font (which is fixed in current
master of the font - but it doesn't seem that they targeted this issue
specifically) or something because of which the limits should be adjusted?

>     Werner

Regards

Marek