Debian Bug report logs - #205055
gs: wrong handling of TrueType font

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Akira TAGOH <tagoh@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gs: wrong handling of TrueType font

Date: Tue, 12 Aug 2003 17:56:19 +0900 (JST)

[Message part 1 (text/plain, inline)]

Package: gs
Version: 7.07-1
Severity: normal
Tags: patch


gs_ttf.ps has two problems (perhaps +1).

one is, if 'post' table is based on version 2, it's likely
TTF hsa a big post table so that CJK TTF has a lot of
glyphs. see http://www.microsoft.com/typography/otspec/post.htm

one is, the current gs_ttf.ps assume TTF always has a Lookup
table and a substitution subtable. but it might has multiple
tables. see http://www.microsoft.com/typography/otspec/gsub.htm

finally, the current gs_ttf.ps also assume the coverage
table is always format 1. but there are format 2. it should
be supported. the attached patch to fix this bug doesn't have the
test enough, though. it will possibly fixes.

Thanks,

-- System Information:
Debian Release: testing/unstable
Architecture: i386
Kernel: Linux amaryllis 2.4.21 #1 Sun Jul 20 12:46:29 JST 2003 i686
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP

Versions of packages gs depends on:
ii  gs-common    0.3.3.1     Common files for different Ghostsc
ii  libc6        2.3.2-2     GNU C Library: Shared libraries an
ii  libgimpprint 4.2.5-3     Gimp-Print printer drivers - core 
ii  libpaper1    1.1.13      Library for handling paper charact
ii  libpng12-0   1.2.5.0-4   PNG library - runtime
ii  xlibs        4.2.1-9     X Window System client libraries
ii  zlib1g       1:1.1.4-14  compression library - runtime

-- no debconf information

--
Akira TAGOH  : tagoh@gnome.gr.jp  / Japan GNOME Users Group
at@gclab.org : tagoh@gnome-db.org / GNOME-DB Project
             : tagoh@redhat.com   / Red Hat, Inc.
             : tagoh@debian.org   / Debian Project

[ghostscript-7.07-bigposttable.patch (text/plain, inline)]

diff -ruN ghostscript-7.07.orig/lib/gs_ttf.ps ghostscript-7.07/lib/gs_ttf.ps
--- ghostscript-7.07.orig/lib/gs_ttf.ps	2003-04-12 23:02:38.000000000 +0900
+++ ghostscript-7.07/lib/gs_ttf.ps	2003-07-24 19:00:37.000000000 +0900
@@ -575,7 +575,7 @@
   (maxp) 1 index
   (name) 1 index
   (OS/2) 1 index
-  (post) 1 index
+  (post) { .readbigtable }
   (vhea) 1 index
 	% Big tables
   (glyf) { .readbigtable }
@@ -918,10 +918,17 @@
   DEBUG { (fontname ) print fontname = } if
 		% Stack: ... /FontInfo mark key1 value1 ...
   post null ne {
-    /ItalicAngle post 4 gets32 65536.0 div
-    /isFixedPitch post 12 getu32 0 ne
-    /UnderlinePosition post 8 gets16 upem div
-    /UnderlineThickness post 10 gets16 upem div
+    post type /arraytype eq {
+      % this post table is a big table. /post should be [(...) ...]
+      % data we actually need here should be first one in array.
+      /posttable post 1 get def
+    } {
+      /posttable post def
+    } ifelse
+    /ItalicAngle posttable 4 gets32 65536.0 div
+    /isFixedPitch posttable 12 getu32 0 ne
+    /UnderlinePosition posttable 8 gets16 upem div
+    /UnderlineThickness posttable 10 gets16 upem div
   } if
   counttomark 0 ne { .dicttomark } { pop pop } ifelse
   /XUID [orgXUID 42 curxuid]

[ghostscript-7.07-gsublookuptable.patch (text/plain, inline)]

diff -ruN ghostscript-7.07.orig/lib/gs_ttf.ps ghostscript-7.07/lib/gs_ttf.ps
--- ghostscript-7.07.orig/lib/gs_ttf.ps	2003-07-29 16:51:55.000000000 +0900
+++ ghostscript-7.07/lib/gs_ttf.ps	2003-07-29 17:44:43.000000000 +0900
@@ -1117,50 +1117,77 @@
   /gsubh2v null def
   tabdict /GSUB .knownget { % if
     dup /gsubver exch 0 getu32 def
-    %dup /gsubosl exch 4 getu16 12 add def
-    %dup /gsubofl exch 6 getu16 12 add def
-    dup /gsuboll exch 8 getu16 12 add def
+    %dup /gsubosl exch 4 getu16 def
+    %dup /gsubofl exch 6 getu16 def
+    dup /gsuboll exch 8 getu16 def
     DEBUG {
       (gsubver: ) print gsubver =
       %(gsubosl: ) print gsubosl =
       %(gsubofl: ) print gsubofl =
       (gsuboll: ) print gsuboll =
     } if
-    dup /gsubfmt exch gsuboll 0 add getu16 def
+    % /gsuboll should be pointed out the LookupList table, but not Lookup table.
+    % so this is wrong:
+    % dup /gsubfmt exch gsuboll 0 add getu16 def
+    dup /gsublc exch gsuboll 0 add getu16 def
     DEBUG {
-      (gsubfmt: ) print gsubfmt =
+      (gsublc: ) print gsublc =
     } if
-%    gsubver 16#00010000 eq { % ifelse
-      gsubfmt 2 eq { % ifelse
-	dup /gsubocv exch gsuboll 2 add getu16 def
-	dup /gsubglc exch gsuboll 4 add getu16 def
-	% hacked by suzuki toshiya at 2001/3/6
-	%dup /gsubvog exch gsuboll 6 add gsubglc getinterval def
-	%dup /gsubhog exch gsuboll gsubocv add 4 add gsubglc getinterval def
-	dup /gsubvog exch gsuboll 6 add gsubglc 2 mul getinterval def
-	dup /gsubhog exch gsuboll gsubocv add 4 add gsubglc 2 mul getinterval def
+    gsublc 0 ne {
+      0 1 gsublc 1 sub {
+	2 mul /gsubolt exch 2 index exch gsuboll 2 add add getu16 gsuboll add def
+	dup /gsubltype exch gsubolt 0 add getu16 def
+	dup /gsublflag exch gsubolt 2 add getu16 def
+	dup /gsubsubc exch gsubolt 4 add getu16 def
 	DEBUG {
-	  (gsubocv: ) print gsubocv =
-	  (gsubglc: ) print gsubglc =
-
-	  (gsubhog->gsubvog ) =
-	  0 2 gsubhog length 2 sub { % for
-	    dup
-	    gsubhog exch getu16 =only
-	    (->) =only
-	    gsubvog exch getu16 =
+	  (gsubolt: ) print gsubolt =
+	  (gsubltype: ) print gsubltype =
+	  (gsublflag: ) print gsublflag =
+	  (gsubsubc: ) print gsubsubc =
+	} if
+	gsubsubc 0 ne {
+	  0 1 gsubsubc 1 sub {
+	    2 mul /gsubost exch 2 index exch gsubolt 6 add add getu16 gsubolt add def
+	    dup /substfmt exch gsubost 0 add getu16 def
+	    DEBUG {
+	      (gsubost: ) print gsubost =
+	      (substfmt: ) print substfmt =
+	    } if
+%	    gsubver 16#00010000 eq { % ifelse
+	    gsubltype 1 eq substfmt 2 eq and { % ifelse
+	      dup /gsubocv exch gsubost 2 add getu16 def
+	      dup /gsubglc exch gsubost 4 add getu16 def
+	      % hacked by suzuki toshiya at 2001/3/6
+	      %dup /gsubvog exch gsubost 6 add gsubglc getinterval def
+	      %dup /gsubhog exch gsubost gsubocv add 4 add gsubglc getinterval def
+	      dup /gsubvog exch gsubost 6 add gsubglc 2 mul getinterval def
+	      dup /gsubhog exch gsubost gsubocv add 4 add gsubglc 2 mul getinterval def
+	      DEBUG {
+		(gsubocv: ) print gsubocv =
+		(gsubglc: ) print gsubglc =
+
+		(gsubhog->gsubvog ) =
+		0 2 gsubhog length 2 sub { % for
+		  dup
+		  gsubhog exch getu16 =only
+		  (->) =only
+		  gsubvog exch getu16 =
+		} for
+	      } if
+	      /gsubh2v << 0 2 gsubhog length 2 sub {
+		dup gsubhog exch getu16
+		exch gsubvog exch getu16
+	      } for >> def
+	    } {
+	      %(UNKNOWN GSUB FORMAT.) = flush
+	    } ifelse
+%	    } {
+%	      (ILLEGAL GSUB VERSION.) = flush
+%	    } ifelse
 	  } for
 	} if
-	/gsubh2v << 0 2 gsubhog length 2 sub {
-	  dup gsubhog exch getu16
-	  exch gsubvog exch getu16
-	} for >> def
-      } {
-	%(UNKNOWN GSUB FORMAT.) = flush
-      } ifelse
-%    } {
-%      (ILLEGAL GSUB VERSION.) = flush
-%    } ifelse
+      } for
+    } if
     pop
   } if
 } bind def

[ghostscript-7.07-coverage-glyphcount.patch (text/plain, inline)]

diff -ruN ghostscript-7.07.orig/lib/gs_ttf.ps ghostscript-7.07/lib/gs_ttf.ps
--- ghostscript-7.07.orig/lib/gs_ttf.ps	2003-08-04 15:23:15.000000000 +0900
+++ ghostscript-7.07/lib/gs_ttf.ps	2003-08-04 15:22:23.000000000 +0900
@@ -1104,9 +1104,26 @@
 % 4	2	Offset	Coverage(--)
 % 6	2	uint16	GlyphCount
 % 8	2	GlyphID	Substitute(vertically oriented glyphs)
-% --	2	uint16	SubstFormat
-% +2	2	uint16	GlyphCount(same as above GlyphCount)
-% +4	2	GlyphID	GlyphArray(horizontally oriented glyphs)
+%
+% [Coverage Format 1, Individual glyph indices]
+% Index Size    Type    Name of Entry
+% -----------------------------------
+% 0     2       uint16  CoverageFormat (Format identifier-format = 1)
+% 2     2       uint16  GlyphCount (same as above GlyphCount)
+% 4     2       GlyphID GlyphArray (horizontally oriented glyphs)
+%
+% [Coverage Format 2, Range of glyphs
+% Index Size    Type    Name of Entry
+% -----------------------------------
+% 0     2       uint16  CoverageFormat (Format identifier-format = 2)
+% 2     2       uint16  RangeCount
+% 4     2       struct  RangeRecord[RangeCount]
+% [RangeRecord]
+% Index Size    Type    Name of Entry
+% -----------------------------------
+% 0     2       GlyphID First GlyphID in the range
+% 2     2       GlyphID Last GlyphID in the range
+% 4     2       uint16  Coverage Index of first GlpyhID in range
 % -----------------------------------
 % References
 % 1. http://www.microsoft.com/typography/OTSPEC/gsub.htm
@@ -1161,10 +1178,13 @@
 	      %dup /gsubvog exch gsubost 6 add gsubglc getinterval def
 	      %dup /gsubhog exch gsubost gsubocv add 4 add gsubglc getinterval def
 	      dup /gsubvog exch gsubost 6 add gsubglc 2 mul getinterval def
-	      dup /gsubhog exch gsubost gsubocv add 4 add gsubglc 2 mul getinterval def
+	      dup /cvfmt exch gsubost gsubocv add 0 add getu16 def
+	      dup /cvglc exch gsubost gsubocv add 2 add getu16 def
+	      dup /gsubhog exch gsubost gsubocv add 4 add cvglc 2 mul getinterval def
 	      DEBUG {
 		(gsubocv: ) print gsubocv =
 		(gsubglc: ) print gsubglc =
+		(cvfmt: ) print cvfmt =
 
 		(gsubhog->gsubvog ) =
 		0 2 gsubhog length 2 sub { % for
@@ -1174,10 +1194,31 @@
 		  gsubvog exch getu16 =
 		} for
 	      } if
-	      /gsubh2v << 0 2 gsubhog length 2 sub {
-		dup gsubhog exch getu16
-		exch gsubvog exch getu16
-	      } for >> def
+	      cvfmt 1 eq {
+		/gsubh2v << 0 2 gsubhog length 2 sub {
+		  dup gsubhog exch getu16
+		  exch gsubvog exch getu16
+		} for >> def
+	      } {
+		cvfmt 2 eq {
+		  /gsubh2v << 0 6 gsubhog length 6 sub {
+		    dup 0 add /fgid exch gsubhog exch getu16 def
+		    dup 2 add /lgid exch gsubhog exch getu16 def
+		    4 add /cvidx exch gsubhog exch getu16 def
+		    DEBUG {
+		      (fgid: ) print fgid =
+		      (lgid: ) print lgid =
+		      (cvidx: ) print cvidx =
+		    } if
+		    fgid 1 lgid {
+		      dup cvidx add fgid sub
+		      exch gsubvog exch getu16
+		    } for
+		  } for >> def
+		} {
+		  %(UNKNWON COVERAGE FORMAT.) = flush
+		} ifelse
+	      } ifelse
 	    } {
 	      %(UNKNOWN GSUB FORMAT.) = flush
 	    } ifelse

Message #10 received at 205055-close@bugs.debian.org (full text, mbox, reply):

From: Masayuki Hatta (mhatta) <mhatta@debian.org>

To: 205055-close@bugs.debian.org

Subject: Bug#205055: fixed in gs-gpl 8.54.dfsg.1-3

Date: Tue, 17 Oct 2006 15:50:00 -0700

Source: gs-gpl
Source-Version: 8.54.dfsg.1-3

We believe that the bug you reported is fixed in the latest version of
gs-gpl, which is due to be installed in the Debian FTP archive:

gs-gpl_8.54.dfsg.1-3.diff.gz
  to pool/main/g/gs-gpl/gs-gpl_8.54.dfsg.1-3.diff.gz
gs-gpl_8.54.dfsg.1-3.dsc
  to pool/main/g/gs-gpl/gs-gpl_8.54.dfsg.1-3.dsc
gs-gpl_8.54.dfsg.1-3_i386.deb
  to pool/main/g/gs-gpl/gs-gpl_8.54.dfsg.1-3_i386.deb
gs_8.54.dfsg.1-3_all.deb
  to pool/main/g/gs-gpl/gs_8.54.dfsg.1-3_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 205055@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Masayuki Hatta (mhatta) <mhatta@debian.org> (supplier of updated gs-gpl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Wed, 18 Oct 2006 03:48:57 +0900
Source: gs-gpl
Binary: gs-gpl gs
Architecture: source i386 all
Version: 8.54.dfsg.1-3
Distribution: unstable
Urgency: low
Maintainer: Masayuki Hatta (mhatta) <mhatta@debian.org>
Changed-By: Masayuki Hatta (mhatta) <mhatta@debian.org>
Description: 
 gs         - Transitional package
 gs-gpl     - The GPL Ghostscript PostScript interpreter
Closes: 205055 254206
Changes: 
 gs-gpl (8.54.dfsg.1-3) unstable; urgency=low
 .
   * Supports big post table for CMap - closes: #205055
   * Fixed a potential segv problem in src/gdevxini.c, thanks Ian Jackson for providing a patch - closes: #254206
Files: 
 e216f9ce6625859f6506a98e63586487 819 text optional gs-gpl_8.54.dfsg.1-3.dsc
 00a5773e22ae667bd6a6204e6bcb1b2d 192931 text optional gs-gpl_8.54.dfsg.1-3.diff.gz
 4c9f8b4bd061790c48b42085567077bb 5482640 text optional gs-gpl_8.54.dfsg.1-3_i386.deb
 c8dc81fa4ce84dd03a06ea014fc7ce0d 13960 text extra gs_8.54.dfsg.1-3_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFNS1Ey2+jQOcHWlQRAitGAJ9kngr8e6hpXJl6GHOovvFcRBfA0wCeKrYx
Z9pbHZblm0wmyl4sKKnpOaQ=
=1t54
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.