Add debug printfs.

CHANGES.md

@@ -2,16 +2,23 @@ Changes in PDFio
 ================
 
 
-v1.3.1 (August 5, 2024)
+v1.3.2 - YYYY-MM-DD
------------------------
+-------------------
+
+- Added some more sanity checks to the TrueType font reader.
+- Fixed an issue when opening certain encrypted PDF files (Issue #62)
+
+
+v1.3.1 - 2024-08-05
+-------------------
 
 - CVE 2024-42358: Updated TrueType font reader to avoid large memory
   allocations.
 - Fixed some documentation errors and added examples (Issue #68, Issue #69)
 
 
-v1.3.0 (June 28, 2024)
+v1.3.0 - 2024-06-28
-----------------------
+-------------------
 
 - Added `pdfioFileGetCatalog` API for accessing the root/catalog object of a
   PDF file (Issue #67)
@@ -21,8 +28,8 @@ v1.3.0 (June 28, 2024)
 - Optimized string pool code.
 
 
-v1.2.0 (January 24, 2024)
+v1.2.0 - 2024-01-24
--------------------------
+-------------------
 
 - Now use autoconf to configure the PDFio sources (Issue #54)
 - Added `pdfioFileCreateNumberObj` and `pdfioFileCreateStringObj` functions
@@ -45,8 +52,8 @@ v1.2.0 (January 24, 2024)
   65536 in the xref table (Issue #59)
 
 
-v1.1.4 (December 3, 2023)
+v1.1.4 - 2023-12-03
--------------------------
+-------------------
 
 - Fixed detection of encrypted strings that are too short (Issue #52)
 - Fixed a TrueType CMAP decoding bug.
@@ -54,15 +61,15 @@ v1.1.4 (December 3, 2023)
 - Added a ToUnicode map for Unicode text to support text copying.
 
 
-v1.1.3 (November 15, 2023)
+v1.1.3 - 2023-11-15
---------------------------
+-------------------
 
 - Fixed Unicode font support (Issue #16)
 - Fixed missing initializer for 40-bit RC4 encryption (Issue #51)
 
 
-v1.1.2 (October 10, 2023)
+v1.1.2 - 2023-10-10
--------------------------
+-------------------
 
 - Updated `pdfioContentSetDashPattern` to support setting a solid (0 length)
   dash pattern (Issue #41)
@@ -77,15 +84,15 @@ v1.1.2 (October 10, 2023)
   (Issue #48)
 
 
-v1.1.1 (March 20, 2023)
+v1.1.1 - 2023-03-20
------------------------
+-------------------
 
 - CVE-2023-28428: Fixed a potential denial-of-service with corrupt PDF files.
 - Fixed a few build issues.
 
 
-v1.1.0 (February 6, 2023)
+v1.1.0 - 2023-02-06
--------------------------
+-------------------
 
 - CVE-2023-24808: Fixed a potential denial-of-service with corrupt PDF files.
 - Added `pdfioFileCreateTemporary` function (Issue #29)
@@ -99,28 +106,28 @@ v1.1.0 (February 6, 2023)
 - Fixed `pdfioContentMatrixRotate` function.
 
 
-v1.0.1 (March 2, 2022)
+v1.0.1 - 2022-03-02
-----------------------
+-------------------
 
 - Added missing `pdfioPageGetNumStreams` and `pdfioPageOpenStream` functions.
 - Added demo pdfiototext utility.
 - Fixed bug in `pdfioStreamGetToken`.
 
 
-v1.0.0 (December 14, 2021)
+v1.0.0 - 2021-12-14
---------------------------
+-------------------
 
 - First stable release.
 
 
-v1.0rc1 (November 30, 2021)
+v1.0rc1 - 2021-11-30
----------------------------
+--------------------
 
 - Fixed a few stack/buffer overflow bugs discovered via fuzzing.
 
 
-v1.0b2 (November 7, 2021)
+v1.0b2 - 2021-11-07
--------------------------
+-------------------
 
 - Added `pdfioFileCreateOutput` API to support streaming output of PDF
   (Issue #21)
@@ -131,7 +138,7 @@ v1.0b2 (November 7, 2021)
 - Fixed some issues identified by a Coverity scan.
 
 
-v1.0b1 (August 30, 2021)
+v1.0b1 - 2021-08-30
-------------------------
+-------------------
 
 - Initial release

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for pdfio 1.3.1.
+# Generated by GNU Autoconf 2.71 for pdfio 1.3.2.
 #
 # Report bugs to <https://github.com/michaelrsweet/pdfio/issues>.
 #
@@ -610,8 +610,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='pdfio'
 PACKAGE_TARNAME='pdfio'
-PACKAGE_VERSION='1.3.1'
+PACKAGE_VERSION='1.3.2'
-PACKAGE_STRING='pdfio 1.3.1'
+PACKAGE_STRING='pdfio 1.3.2'
 PACKAGE_BUGREPORT='https://github.com/michaelrsweet/pdfio/issues'
 PACKAGE_URL='https://www.msweet.org/pdfio'
 
@@ -1293,7 +1293,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures pdfio 1.3.1 to adapt to many kinds of systems.
+\`configure' configures pdfio 1.3.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1359,7 +1359,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of pdfio 1.3.1:";;
+     short | recursive ) echo "Configuration of pdfio 1.3.2:";;
    esac
   cat <<\_ACEOF
 
@@ -1456,7 +1456,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-pdfio configure 1.3.1
+pdfio configure 1.3.2
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -1612,7 +1612,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by pdfio $as_me 1.3.1, which was
+It was created by pdfio $as_me 1.3.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -2368,9 +2368,9 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 
-PDFIO_VERSION="1.3.1"
+PDFIO_VERSION="1.3.2"
-PDFIO_VERSION_MAJOR="`echo 1.3.1 | awk -F. '{print $1}'`"
+PDFIO_VERSION_MAJOR="`echo 1.3.2 | awk -F. '{print $1}'`"
-PDFIO_VERSION_MINOR="`echo 1.3.1 | awk -F. '{printf("%d\n",$2);}'`"
+PDFIO_VERSION_MINOR="`echo 1.3.2 | awk -F. '{printf("%d\n",$2);}'`"
 
 
 
@@ -4935,7 +4935,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by pdfio $as_me 1.3.1, which was
+This file was extended by pdfio $as_me 1.3.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -4991,7 +4991,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-pdfio config.status 1.3.1
+pdfio config.status 1.3.2
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -21,7 +21,7 @@ AC_PREREQ([2.70])
 
 
 dnl Package name and version...
-AC_INIT([pdfio], [1.3.1], [https://github.com/michaelrsweet/pdfio/issues], [pdfio], [https://www.msweet.org/pdfio])
+AC_INIT([pdfio], [1.3.2], [https://github.com/michaelrsweet/pdfio/issues], [pdfio], [https://www.msweet.org/pdfio])
 
 PDFIO_VERSION="AC_PACKAGE_VERSION"
 PDFIO_VERSION_MAJOR="`echo AC_PACKAGE_VERSION | awk -F. '{print $1}'`"

pdfio-array.c

@@ -363,6 +363,9 @@ _pdfioArrayDebug(pdfio_array_t *a,	// I - Array
   _pdfio_value_t	*v;		// Current value
 
 
+  if (!a)
+    return;
+
   putc('[', fp);
   for (i = a->num_values, v = a->values; i > 0; i --, v ++)
     _pdfioValueDebug(v, fp);

pdfio-dict.c

@@ -194,6 +194,9 @@ _pdfioDictDebug(pdfio_dict_t *dict,	// I - Dictionary
   _pdfio_pair_t	*pair;			// Current pair
 
 
+  if (!dict)
+    return;
+
   for (i = dict->num_pairs, pair = dict->pairs; i > 0; i --, pair ++)
   {
     fprintf(fp, "/%s", pair->key);

pdfio-file.c

@@ -188,6 +188,8 @@ pdfioFileCreate(
   int		fd;			// File descriptor
 
 
+  PDFIO_DEBUG("pdfioFileCreate(filename=\"%s\", version=\"%s\", media_box=%p, crop_box=%p, error_cb=%p, error_cbdata=%p)\n", filename, version, (void *)media_box, (void *)crop_box, (void *)error_cb, (void *)error_cbdata);
+
   // Range check input...
   if (!filename)
     return (NULL);
@@ -390,6 +392,8 @@ pdfioFileCreateOutput(
     pdfio_error_cb_t  error_cb,		// I - Error callback or `NULL` for default
     void              *error_cbdata)	// I - Error callback data, if any
 {
+  PDFIO_DEBUG("pdfioFileCreate(output_cb=%p, output_cbdata=%p, version=\"%s\", media_box=%p, crop_box=%p, error_cb=%p, error_cbdata=%p)\n", (void *)output_cb, (void *)output_cbdata, version, (void *)media_box, (void *)crop_box, (void *)error_cb, (void *)error_cbdata);
+
   return (create_common("output.pdf", /*fd*/-1, output_cb, output_cbdata, version, media_box, crop_box, error_cb, error_cbdata));
 }
 
@@ -524,6 +528,8 @@ pdfioFileCreateTemporary(
   unsigned	tmpnum;			// Temporary filename number
 
 
+  PDFIO_DEBUG("pdfioFileCreate(buffer=%p, bufsize=%lu, version=\"%s\", media_box=%p, crop_box=%p, error_cb=%p, error_cbdata=%p)\n", (void *)buffer, (unsigned long)bufsize, version, (void *)media_box, (void *)crop_box, (void *)error_cb, (void *)error_cbdata);
+
   // Range check input...
   if (!buffer || bufsize < 32)
   {
@@ -648,11 +654,12 @@ pdfioFileFindObj(
   if ((current = number - 1) >= pdf->num_objs)
     current = pdf->num_objs / 2;
 
-  PDFIO_DEBUG("pdfioFileFindObj: objs[current=%lu]=%p\n", (unsigned long)current, (void *)pdf->objs[current]);
+  PDFIO_DEBUG("pdfioFileFindObj: objs[current=%lu]=%p(%lu)\n", (unsigned long)current, (void *)pdf->objs[current], (unsigned long)(pdf->objs[current] ? pdf->objs[current]->number : 0));
 
   if (number == pdf->objs[current]->number)
   {
     // Fast match...
+    PDFIO_DEBUG("pdfioFileFindObj: Returning %lu (%p)\n", (unsigned long)current, pdf->objs[current]);
     return (pdf->objs[current]);
   }
   else if (number < pdf->objs[current]->number)
@@ -679,11 +686,20 @@ pdfioFileFindObj(
   }
 
   if (number == pdf->objs[left]->number)
+  {
+    PDFIO_DEBUG("pdfioFileFindObj: Returning %lu (%p)\n", (unsigned long)left, pdf->objs[left]);
     return (pdf->objs[left]);
+  }
   else if (number == pdf->objs[right]->number)
+  {
+    PDFIO_DEBUG("pdfioFileFindObj: Returning %lu (%p)\n", (unsigned long)right, pdf->objs[right]);
     return (pdf->objs[right]);
+  }
   else
+  {
+    PDFIO_DEBUG("pdfioFileFindObj: Returning NULL\n");
     return (NULL);
+  }
 }
 
 
@@ -928,6 +944,8 @@ pdfioFileOpen(
   off_t		xref_offset;		// Offset to xref table
 
 
+  PDFIO_DEBUG("pdfioFileOpen(filename=\"%s\", password_cb=%p, password_cbdata=%p, error_cb=%p, error_cbdata=%p)\n", filename, (void *)password_cb, (void *)password_cbdata, (void *)error_cb, (void *)error_cbdata);
+
   // Range check input...
   if (!filename)
     return (NULL);
@@ -1285,6 +1303,8 @@ create_common(
   unsigned char	id_value[16];		// File ID value
 
 
+  PDFIO_DEBUG("create_common(filename=\"%s\", fd=%d, output_cb=%p, output_cbdata=%p, version=\"%s\", media_box=%p, crop_box=%p, error_cb=%p, error_cbdata=%p)\n", filename, fd, (void *)output_cb, (void *)output_cbdata, version, (void *)media_box, (void *)crop_box, (void *)error_cb, (void *)error_cbdata);
+
   // Range check input...
   if (!filename || (fd < 0 && !output_cb))
     return (NULL);

pdfio-stream.c

@@ -408,6 +408,7 @@ _pdfioStreamOpen(pdfio_obj_t *obj,	// I - Object
   pdfio_stream_t	*st;		// Stream
   pdfio_dict_t		*dict = pdfioObjGetDict(obj);
 					// Object dictionary
+  const char		*type;		// Object type
 
 
   PDFIO_DEBUG("_pdfioStreamOpen(obj=%p(%u), decode=%s)\n", obj, (unsigned)obj->number, decode ? "true" : "false");
@@ -434,7 +435,9 @@ _pdfioStreamOpen(pdfio_obj_t *obj,	// I - Object
     return (NULL);
   }
 
-  if (obj->pdf->encryption)
+  type = pdfioObjGetType(obj);
+
+  if (obj->pdf->encryption && (!type || strcmp(type, "XRef")))
   {
     uint8_t	iv[64];			// Initialization vector
     size_t	ivlen;			// Length of initialization vector, if any
@@ -1069,11 +1072,6 @@ stream_read(pdfio_stream_t *st,		// I - Stream
 	_pdfioFileError(st->pdf, "Unable to decompress stream data for object %ld: %s", (long)st->obj->number, zstrerror(status));
 	return (-1);
       }
-      else if (avail_in == st->flate.avail_in && avail_out == st->flate.avail_out)
-      {
-	_pdfioFileError(st->pdf, "Corrupt stream data.");
-	return (-1);
-      }
 
       return (st->flate.next_out - (Bytef *)buffer);
     }

pdfio-value.c

@@ -215,6 +215,9 @@ void
 _pdfioValueDebug(_pdfio_value_t *v,	// I - Value
 		 FILE           *fp)	// I - Output file
 {
+  if (!v)
+    return;
+
   switch (v->type)
   {
     case PDFIO_VALTYPE_ARRAY :

pdfio1.def

@@ -1,7 +1,8 @@
 LIBRARY pdfio1
-VERSION 1.2
+VERSION 1.3
 EXPORTS
 _pdfioArrayDebug
+_pdfioArrayDecrypt
 _pdfioArrayDelete
 _pdfioArrayGetValue
 _pdfioArrayRead
@@ -24,6 +25,7 @@ _pdfioCryptoSHA256Init
 _pdfioCryptoUnlock
 _pdfioDictClear
 _pdfioDictDebug
+_pdfioDictDecrypt
 _pdfioDictDelete
 _pdfioDictGetValue
 _pdfioDictRead
@@ -61,9 +63,12 @@ _pdfioTokenPush
 _pdfioTokenRead
 _pdfioValueCopy
 _pdfioValueDebug
+_pdfioValueDecrypt
 _pdfioValueDelete
 _pdfioValueRead
 _pdfioValueWrite
+_pdfio_strtod
+_pdfio_vsnprintf
 pdfioArrayAppendArray
 pdfioArrayAppendBinary
 pdfioArrayAppendBoolean
@@ -190,6 +195,7 @@ pdfioFileCreateStringObj
 pdfioFileCreateTemporary
 pdfioFileFindObj
 pdfioFileGetAuthor
+pdfioFileGetCatalog
 pdfioFileGetCreationDate
 pdfioFileGetCreator
 pdfioFileGetID

pdfio_native.nuspec

@@ -3,7 +3,7 @@
     <metadata>
         <id>pdfio_native</id>
         <title>PDFio Library for VS2019+</title>
-        <version>1.3.1</version>
+        <version>1.3.2</version>
         <authors>Michael R Sweet</authors>
         <owners>michaelrsweet</owners>
         <projectUrl>https://github.com/michaelrsweet/pappl</projectUrl>
@@ -16,7 +16,7 @@
         <copyright>Copyright © 2019-2024 by Michael R Sweet</copyright>
         <tags>pdf file native</tags>
 	<dependencies>
-	    <dependency id="pdfio_native.redist" version="1.3.1" />
+	    <dependency id="pdfio_native.redist" version="1.3.2" />
 	    <dependency id="zlib_native.redist" version="1.2.11" />
 	</dependencies>
     </metadata>

pdfio_native.redist.nuspec

@@ -3,7 +3,7 @@
     <metadata>
         <id>pdfio_native.redist</id>
         <title>PDFio Library for VS2019+</title>
-        <version>1.3.1</version>
+        <version>1.3.2</version>
         <authors>Michael R Sweet</authors>
         <owners>michaelrsweet</owners>
         <projectUrl>https://github.com/michaelrsweet/pappl</projectUrl>

testpdfio.c

@@ -27,7 +27,7 @@
 //
 
 static int	do_crypto_tests(void);
-static int	do_test_file(const char *filename, int objnum, bool verbose);
+static int	do_test_file(const char *filename, int objnum, const char *password, bool verbose);
 static int	do_unit_tests(void);
 static int	draw_image(pdfio_stream_t *st, const char *name, double x, double y, double w, double h, const char *label);
 static bool	error_cb(pdfio_file_t *pdf, const char *message, bool *error);
@@ -37,6 +37,7 @@ static const char *password_cb(void *data, const char *filename);
 static int	read_unit_file(const char *filename, size_t num_pages, size_t first_image, bool is_output);
 static ssize_t	token_consume_cb(const char **s, size_t bytes);
 static ssize_t	token_peek_cb(const char **s, char *buffer, size_t bytes);
+static int	usage(FILE *fp);
 static int	verify_image(pdfio_file_t *pdf, size_t number);
 static int	write_alpha_test(pdfio_file_t *pdf, int number, pdfio_obj_t *font);
 static int	write_color_patch(pdfio_stream_t *st, bool device);
@@ -62,19 +63,30 @@ main(int  argc,				// I - Number of command-line arguments
   int		ret = 0;		// Return value
 
 
-  fprintf(stderr, "testpdfio: Test locale is \"%s\".\n", setlocale(LC_ALL, getenv("LANG")));
-
   if (argc > 1)
   {
     int		i;			// Looping var
+    const char	*password = NULL;	// Password
     bool	verbose = false;	// Be verbose?
 
     for (i = 1; i < argc; i ++)
     {
       if (!strcmp(argv[i], "--help"))
       {
-        puts("Usage: ./testpdfio [--help] [--verbose] [filename [objnum] ...]");
+        return (usage(stdout));
-        return (0);
+      }
+      else if (!strcmp(argv[i], "--password"))
+      {
+        i ++;
+        if (i < argc)
+        {
+          password = argv[i];
+        }
+        else
+        {
+          fputs("testpdfio: Missing password after '--password'.\n", stderr);
+          return (usage(stderr));
+        }
       }
       else if (!strcmp(argv[i], "--verbose"))
       {
@@ -82,24 +94,27 @@ main(int  argc,				// I - Number of command-line arguments
       }
       else if (argv[i][0] == '-')
       {
-        printf("Unknown option '%s'.\n\n", argv[i]);
+        fprintf(stderr, "testpdfio: Unknown option '%s'.\n", argv[i]);
-        puts("Usage: ./testpdfio [--help] [--verbose] [filename [objnum] ...]");
+        return (usage(stderr));
-        return (1);
       }
       else if ((i + 1) < argc && isdigit(argv[i + 1][0] & 255))
       {
         // filename.pdf object-number
-        if (do_test_file(argv[i], atoi(argv[i + 1]), verbose))
+        if (do_test_file(argv[i], atoi(argv[i + 1]), password, verbose))
 	  ret = 1;
 
 	i ++;
       }
-      else if (do_test_file(argv[i], 0, verbose))
+      else if (do_test_file(argv[i], 0, password, verbose))
+      {
         ret = 1;
       }
     }
+  }
   else
   {
+    fprintf(stderr, "testpdfio: Test locale is \"%s\".\n", setlocale(LC_ALL, getenv("LANG")));
+
 #if _WIN32
     // Windows puts executables in Platform/Configuration subdirs...
     if (!_access("../../testfiles", 0))
@@ -363,6 +378,7 @@ do_crypto_tests(void)
 static int				// O - Exit status
 do_test_file(const char *filename,	// I - PDF filename
              int        objnum,		// I - Object number to dump, if any
+             const char *password,	// I - Password for file
              bool       verbose)	// I - Be verbose?
 {
   bool		error = false;		// Have we shown an error yet?
@@ -381,7 +397,7 @@ do_test_file(const char *filename,	// I - PDF filename
     fflush(stdout);
   }
 
-  if ((pdf = pdfioFileOpen(filename, /*password_cb*/NULL, /*password_data*/NULL, (pdfio_error_cb_t)error_cb, &error)) != NULL)
+  if ((pdf = pdfioFileOpen(filename, password_cb, (void *)password, (pdfio_error_cb_t)error_cb, &error)) != NULL)
   {
     if (objnum)
     {
@@ -1559,6 +1575,23 @@ token_peek_cb(const char **s,		// IO - Test string
 }
 
 
+//
+// 'usage()' - Show program usage.
+//
+
+static int				// O - Exit status
+usage(FILE *fp)				// I - Output file
+{
+  fputs("Usage: ./testpdfio [OPTIONS] [FILENAME [OBJNUM]] ...\n", fp);
+  fputs("Options:\n", fp);
+  fputs("  --help               Show program help.\n", fp);
+  fputs("  --password PASSWORD  Set PDF password.\n", fp);
+  fputs("  --verbose            Be verbose.\n", fp);
+
+  return (fp != stdout);
+}
+
+
 //
 // 'verify_image()' - Verify an image object.
 //

testttf.c

@@ -3,7 +3,7 @@
 //
 //     https://github.com/michaelrsweet/ttf
 //
-// Copyright © 2018-2023 by Michael R Sweet.
+// Copyright © 2018-2024 by Michael R Sweet.
 //
 // Licensed under Apache License v2.0.  See the file "LICENSE" for more
 // information.
@@ -120,6 +120,7 @@ test_font(const char *filename)		// I - Font filename
 
 
   printf("ttfCreate(\"%s\"): ", filename);
+  fflush(stdout);
   if ((font = ttfCreate(filename, 0, error_cb, NULL)) != NULL)
     puts("PASS");
   else

ttf.c

@@ -62,7 +62,7 @@
 #  define O_CREAT	_O_CREAT
 #  define O_TRUNC	_O_TRUNC
 
-typedef __int64 ssize_t;		// POSIX type not present on Windows...
+typedef __int64 ssize_t;		// POSIX type not present on Windows... @private@
 
 #else
 #  include <unistd.h>
@@ -100,6 +100,8 @@ typedef __int64 ssize_t;		// POSIX type not present on Windows...
 
 #define TTF_FONT_MAX_CHAR	262144	// Maximum number of character values
 #define TTF_FONT_MAX_GROUPS	65536	// Maximum number of sub-groups
+#define TTF_FONT_MAX_NAMES	16777216// Maximum size of names table we support
+
 
 //
 // TTF/OFF tag constants...
@@ -254,7 +256,7 @@ typedef struct _ttf_off_hhea_s		// Horizontal header
 {
   short		ascender,		// Ascender
 		descender;		// Descender
-  int		numberOfHMetrics;	// Number of horizontal metrics
+  unsigned short numberOfHMetrics;	// Number of horizontal metrics
 } _ttf_off_hhea_t;
 
 typedef struct _ttf_off_os_2_s		// OS/2 information
@@ -297,7 +299,28 @@ static unsigned	seek_table(ttf_t *font, unsigned tag, unsigned offset, bool requ
 
 
 //
-// 'ttfCreate()' - Create a new font object for the named font family.
+// 'ttfCreate()' - Create a new font object for the named font file.
+//
+// This function creates a new font object for the named TrueType or OpenType
+// font file or collection.  The "filename" argument specifies the name of the
+// file to read.
+//
+// The "idx" argument specifies the font to load from a collection - the first
+// font is number `0`.  Once created, you can call the @link ttfGetNumFonts@
+// function to determine whether the loaded font file is a collection with more
+// than one font.
+//
+// The "err_cb" and "err_data" arguments specify a callback function and data
+// pointer for receiving error messages.  If `NULL`, errors are sent to the
+// `stderr` file.  The callback function receives the data pointer and a text
+// message string, for example:
+//
+// ```
+// void my_err_cb(void *err_data, const char *message)
+// {
+//   fprintf(stderr, "ERROR: %s\n", message);
+// }
+// ```
 //
 
 ttf_t *					// O - New font object
@@ -550,6 +573,10 @@ ttfGetAscent(ttf_t *font)		// I - Font
 //
 // 'ttfGetBounds()' - Get the bounds of all characters in a font.
 //
+// This function gets the bounds of all characters in a font.  The "bounds"
+// argument is a pointer to a `ttf_rect_t` structure that will be filled with
+// the limits for characters in the font scaled to a 1000x1000 unit square.
+//
 
 ttf_rect_t *				// O - Bounds or `NULL` on error
 ttfGetBounds(ttf_t      *font,		// I - Font
@@ -631,8 +658,11 @@ ttfGetDescent(ttf_t *font)		// I - Font
 //
 // 'ttfGetExtents()' - Get the extents of a UTF-8 string.
 //
-// This function computes the extents of a UTF-8 string when rendered using the
+// This function computes the extents of the UTF-8 string "s" when rendered
-// specified font and size.
+// using the specified font "font" and size "size".  The "extents" argument is
+// a pointer to a `ttf_rect_t` structure that is filled with the extents of a
+// simple rendering of the string with no kerning or rewriting applied.  The
+// values are scaled using the specified font size.
 //
 
 ttf_rect_t *				// O - Pointer to extents or `NULL` on error
@@ -1272,21 +1302,28 @@ read_cmap(ttf_t *font)			// I - Font
           for (i = 0; i < numGlyphIdArray; i ++)
             glyphIdArray[i] = read_ushort(font);
 
-#ifdef DEBUG
+          for (i = 0, segment = segments; i < segCount; i ++, segment ++)
-          for (i = 0; i < segCount; i ++)
+          {
-            TTF_DEBUG("read_cmap: segment[%d].startCode=%d, endCode=%d, idDelta=%d, idRangeOffset=%d\n", i, segments[i].startCode, segments[i].endCode, segments[i].idDelta, segments[i].idRangeOffset);
+            TTF_DEBUG("read_cmap: segment[%d].startCode=%d, endCode=%d, idDelta=%d, idRangeOffset=%d\n", i, segment->startCode, segment->endCode, segment->idDelta, segment->idRangeOffset);
 
+            if (segment->startCode > segment->endCode)
+            {
+	      errorf(font, "Bad cmap table segment %u to %u.", segments->startCode, segment->endCode);
+	      return (false);
+            }
+
+            // Based on the end code of the segment table, allocate space for the
+            // uncompressed cmap table...
+            if (segment->endCode >= font->num_cmap)
+	      font->num_cmap = segment->endCode + 1;
+          }
+
+#ifdef DEBUG
           for (i = 0; i < numGlyphIdArray; i ++)
             TTF_DEBUG("read_cmap: glyphIdArray[%d]=%d\n", i, glyphIdArray[i]);
 #endif /* DEBUG */
 
-          // Based on the end code of the segent table, allocate space for the
+	  if (font->num_cmap == 0 || font->num_cmap > TTF_FONT_MAX_CHAR)
-          // uncompressed cmap table...
-//          segCount --;			// Last segment is not used (sigh)
-
-	  font->num_cmap = segments[segCount - 1].endCode + 1;
-
-	  if (font->num_cmap > TTF_FONT_MAX_CHAR)
 	  {
 	    errorf(font, "Invalid cmap table with %u characters.", (unsigned)font->num_cmap);
 	    return (false);
@@ -1382,6 +1419,12 @@ read_cmap(ttf_t *font)			// I - Font
 	    group->startGlyphID  = read_ulong(font);
 	    TTF_DEBUG("read_cmap: [%u] startCharCode=%u, endCharCode=%u, startGlyphID=%u\n", gidx, group->startCharCode, group->endCharCode, group->startGlyphID);
 
+            if (group->startCharCode > group->endCharCode)
+            {
+	      errorf(font, "Bad cmap table segment %u to %u.", group->startCharCode, group->endCharCode);
+	      return (false);
+            }
+
             if (group->endCharCode >= font->num_cmap)
               font->num_cmap = group->endCharCode + 1;
 	  }
@@ -1390,7 +1433,7 @@ read_cmap(ttf_t *font)			// I - Font
 	  // uncompressed cmap table...
           TTF_DEBUG("read_cmap: num_cmap=%u\n", (unsigned)font->num_cmap);
 
-	  if (font->num_cmap > TTF_FONT_MAX_CHAR)
+	  if (font->num_cmap == 0 || font->num_cmap > TTF_FONT_MAX_CHAR)
 	  {
 	    errorf(font, "Invalid cmap table with %u characters.", (unsigned)font->num_cmap);
 	    return (false);
@@ -1465,6 +1508,12 @@ read_cmap(ttf_t *font)			// I - Font
 	    group->glyphID       = read_ulong(font);
 	    TTF_DEBUG("read_cmap: [%u] startCharCode=%u, endCharCode=%u, glyphID=%u\n", gidx, group->startCharCode, group->endCharCode, group->glyphID);
 
+            if (group->startCharCode > group->endCharCode)
+            {
+	      errorf(font, "Bad cmap table segment %u to %u.", group->startCharCode, group->endCharCode);
+	      return (false);
+            }
+
             if (group->endCharCode >= font->num_cmap)
               font->num_cmap = group->endCharCode + 1;
 	  }
@@ -1473,7 +1522,7 @@ read_cmap(ttf_t *font)			// I - Font
 	  // uncompressed cmap table...
           TTF_DEBUG("read_cmap: num_cmap=%u\n", (unsigned)font->num_cmap);
 
-	  if (font->num_cmap > TTF_FONT_MAX_CHAR)
+	  if (font->num_cmap == 0 || font->num_cmap > TTF_FONT_MAX_CHAR)
 	  {
 	    errorf(font, "Invalid cmap table with %u characters.", (unsigned)font->num_cmap);
 	    return (false);
@@ -1598,7 +1647,7 @@ read_hmtx(ttf_t           *font,	// I - Font
           _ttf_off_hhea_t *hhea)	// O - hhea table data
 {
   unsigned	length;			// Length of hmtx table
-  int		i;			// Looping var
+  unsigned	i;			// Looping var
   _ttf_metric_t	*widths;		// Glyph metrics array
 
 
@@ -1677,8 +1726,15 @@ read_names(ttf_t *font)			// I - Font
     return (false);
 
   font->names.storage_size = length - (unsigned)offset;
+  if (font->names.storage_size > TTF_FONT_MAX_NAMES)
+  {
+    errorf(font, "Name table too large - %u bytes.", (unsigned)font->names.storage_size);
+    return (false);
+  }
+
   if ((font->names.storage = malloc(font->names.storage_size)) == NULL)
     return (false);
+
   memset(font->names.storage, 'A', font->names.storage_size);
 
   for (i = font->names.num_names, name = font->names.names; i > 0; i --, name ++)

ttf.h

@@ -3,7 +3,7 @@
 //
 //     https://github.com/michaelrsweet/ttf
 //
-// Copyright © 2018-2023 by Michael R Sweet.
+// Copyright © 2018-2024 by Michael R Sweet.
 //
 // Licensed under Apache License v2.0.  See the file "LICENSE" for more
 // information.
@@ -22,12 +22,12 @@ extern "C" {
 // Types...
 //
 
-typedef struct _ttf_s ttf_t;	//// Font object
+typedef struct _ttf_s ttf_t;	// Font object
 
 typedef void (*ttf_err_cb_t)(void *data, const char *message);
-				//// Font error callback
+				// Font error callback
 
-typedef enum ttf_stretch_e	//// Font stretch
+typedef enum ttf_stretch_e	// Font stretch
 {
   TTF_STRETCH_NORMAL,		// normal
   TTF_STRETCH_ULTRA_CONDENSED,	// ultra-condensed
@@ -40,20 +40,20 @@ typedef enum ttf_stretch_e	//// Font stretch
   TTF_STRETCH_ULTRA_EXPANDED	// ultra-expanded
 } ttf_stretch_t;
 
-typedef enum ttf_style_e	//// Font style
+typedef enum ttf_style_e	// Font style
 {
   TTF_STYLE_NORMAL,		// Normal font
   TTF_STYLE_ITALIC,		// Italic font
   TTF_STYLE_OBLIQUE		// Oblique (angled) font
 } ttf_style_t;
 
-typedef enum ttf_variant_e	//// Font variant
+typedef enum ttf_variant_e	// Font variant
 {
   TTF_VARIANT_NORMAL,		// Normal font
   TTF_VARIANT_SMALL_CAPS	// Font whose lowercase letters are small capitals
 } ttf_variant_t;
 
-typedef enum ttf_weight_e	//// Font weight
+typedef enum ttf_weight_e	// Font weight
 {
   TTF_WEIGHT_100 = 100,		// Weight 100 (Thin)
   TTF_WEIGHT_200 = 200,		// Weight 200 (Extra/Ultra-Light)
@@ -66,7 +66,7 @@ typedef enum ttf_weight_e	//// Font weight
   TTF_WEIGHT_900 = 900		// Weight 900 (Black/Heavy)
 } ttf_weight_t;
 
-typedef struct ttf_rect_s	//// Bounding rectangle
+typedef struct ttf_rect_s	// Bounding rectangle
 {
   float	left;			// Left offset
   float	top;			// Top offset