- same CFF loader fix (stricter checking though than Werner's version)

- document light auto-hinter improvements

ChangeLog

@@ -1,3 +1,15 @@
+2007-01-25  David Turner  <david@freetype.org>
+
+	* src/cff/cffload.c (cff_index_get_pointers): fixed a bug in the
+	sanity check which caused the last entry in each index to become
+	empty. since this function is only used to load local and global
+	functions, this meant that any charstring that called the last
+	local/global function would fail.
+
+	* src/cff/cffgload.c: fixed sanity check for empty functions
+
+	* docs/CHANGES: document light auto-hinting improvement
+
 2007-01-25  Werner Lemberg  <wl@gnu.org>
 
 	* src/cff/cffload.c (cff_index_get_pointers): Handle last entry

docs/CHANGES

@@ -8,6 +8,15 @@ CHANGES BETWEEN 2.3.0 and 2.3.1
     - A typo  in  a  security  check  introduced  after  version 2.2.1
       prevented FreeType to render some glyphs in CFF fonts.
 
+  II. IMPORTANT CHANGES
+
+    - the light auto-hinting mode has been improved and should generate
+      less blurry text in many cases, without changing spacing. This is
+      done by slightly translating/dilating the outline in the horizontal
+      direction in order to better align its features to the pixel grid.
+
+      since the transform is entirely linear, this still provides very
+      good approximations to the original glyph shapes.
 
 ======================================================================
 

src/cff/cffgload.c

@@ -2089,7 +2089,7 @@
             zone->limit  = decoder->locals[idx + 1];
             zone->cursor = zone->base;
 
-            if ( !zone->base )
+            if ( !zone->base || zone->limit == zone->base )
             {
               FT_ERROR(( "cff_decoder_parse_charstrings:"
                          " invoking empty subrs!\n" ));
@@ -2131,7 +2131,7 @@
             zone->limit  = decoder->globals[idx + 1];
             zone->cursor = zone->base;
 
-            if ( !zone->base )
+            if ( !zone->base || zone->limit == zone->base )
             {
               FT_ERROR(( "cff_decoder_parse_charstrings:"
                          " invoking empty subrs!\n" ));

src/cff/cffload.c

@@ -403,11 +403,13 @@
         if ( !offset )
           offset = old_offset;
 
-        /* sanity check for invalid offset tables */
-        else if ( offset     < old_offset     ||
-                  offset - 1 > idx->data_size )
+        /* two sanity checks for invalid offset tables */
+        else if ( offset < old_offset )
           offset = old_offset;
 
+	else if ( offset-1 >= idx->data_size && n < idx->count )
+          offset = old_offset;
+	
         t[n] = idx->bytes + offset - 1;
 
         old_offset = offset;