[poppler] fofi/FoFiType1.cc

[Albert Astals Cid]

 fofi/FoFiType1.cc |   40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

New commits:
commit 0f4ea2f18b1953ccc88bcbd6b16ede828b44e561
Author: Adrian Johnson <ajohnson at redneon.com>
Date:   Mon Jul 10 21:06:30 2017 +0930

    Fix parsing of Type 1 fonts with newlines in encoding sequences
    
    Adobe Type 1 font spec states that the encoding sequences should be of
    the form:
    
      dup index /name put
    
    The bug 101728 test case has the encoding sequences in the form:
    
      dup
      index /name put
    
    Make the Type 1 parse handle encoding sequences split over more than one line.
    
    Bug 101728

diff --git a/fofi/FoFiType1.cc b/fofi/FoFiType1.cc
index 151f2d5f..8974cc99 100644
--- a/fofi/FoFiType1.cc
+++ b/fofi/FoFiType1.cc
@@ -17,6 +17,7 @@
 // Copyright (C) 2005 Kristian Høgsberg <krh at redhat.com>
 // Copyright (C) 2010 Jakub Wilk <jwilk at jwilk.net>
 // Copyright (C) 2014 Carlos Garcia Campos <carlosgc at gnome.org>
+// Copyright (C) 2017 Adrian Johnson <ajohnson at redneon.com>
 //
 // To see a description of the changes please see the Changelog file that
 // came with your tarball or type make ChangeLog if you are building from git
@@ -209,12 +210,12 @@ char *FoFiType1::getNextLine(char *line) {
 }
 
 void FoFiType1::parse() {
-  char *line, *line1, *p, *p2;
+  char *line, *line1, *firstLine, *p, *p2;
   char buf[256];
   char c;
   int n, code, base, i, j;
   char *tokptr;
-  GBool gotMatrix;
+  GBool gotMatrix, continueLine;
 
   gotMatrix = gFalse;
   for (i = 1, line = (char *)file;
@@ -241,6 +242,7 @@ void FoFiType1::parse() {
       for (j = 0; j < 256; ++j) {
 	encoding[j] = NULL;
       }
+      continueLine = gFalse;
       for (j = 0, line = getNextLine(line);
 	   j < 300 && line && (line1 = getNextLine(line));
 	   ++j, line = line1) {
@@ -248,8 +250,26 @@ void FoFiType1::parse() {
 	  error(errSyntaxWarning, -1, "FoFiType1::parse a line has more than 255 characters, we don't support this");
 	  n = 255;
 	}
-	strncpy(buf, line, n);
-	buf[n] = '\0';
+	if (continueLine) {
+	  continueLine = gFalse;
+	  if ((line1 - firstLine) + 1 > (int)sizeof(buf))
+	    break;
+	  p = firstLine;
+	  p2 = buf;
+	  while (p < line1) {
+	    if (*p == '\n' || *p == '\r') {
+	      *p2++ = ' ';
+	      p++;
+	    } else {
+	      *p2++ = *p++;
+	    }
+	  }
+	  *p2 = '\0';
+	} else {
+	  firstLine = line;
+	  strncpy(buf, line, n);
+	  buf[n] = '\0';
+	}
 	for (p = buf; *p == ' ' || *p == '\t'; ++p) ;
 	if (!strncmp(p, "dup", 3)) {
 	  while (1) {
@@ -261,6 +281,9 @@ void FoFiType1::parse() {
 	      p += 2;
 	    } else if (*p >= '0' && *p <= '9') {
 	      base = 10;
+	    } else if (*p == '\n' || *p == '\r') {
+	      continueLine = gTrue;
+	      break;
 	    } else {
 	      break;
 	    }
@@ -268,7 +291,10 @@ void FoFiType1::parse() {
 	      code = code * base + (*p - '0');
 	    }
 	    for (; *p == ' ' || *p == '\t'; ++p) ;
-	    if (*p != '/') {
+	    if (*p == '\n' || *p == '\r') {
+	      continueLine = gTrue;
+	      break;
+	    } else if (*p != '/') {
 	      break;
 	    }
 	    ++p;
@@ -280,6 +306,10 @@ void FoFiType1::parse() {
 	      *p2 = c;
 	    }
 	    for (p = p2; *p == ' ' || *p == '\t'; ++p) ;
+	    if (*p == '\n' || *p == '\r') {
+	      continueLine = gTrue;
+	      break;
+	    }
 	    if (strncmp(p, "put", 3)) {
 	      break;
 	    }