From 6d403d089d438f3a3f9a13c47e2c93528819f265 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sun, 24 Sep 2017 09:06:01 +0200
Subject: [PATCH] Fix handling of ValueRecords.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For GPOS pair positioning format 1 the description of ValueRecords
in the OpenType specification (1.8.2, from today) is wrong – the
offset has to be taken from the parent structure; in this case the
`PairSet' table.

* src/otvalid/otvgpos.c (otv_PairSet_validate): Set `extra3'.
(otv_PairPos_validate): Adjust.
---
 ChangeLog             | 12 ++++++++++++
 src/otvalid/otvgpos.c | 12 ++++++------
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 58b2fb4fd..901e1c638 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,18 @@
 	* build/windows/ftver.rc: New VERSIONINFO resource.
 	* build/windows/vc2010/freetype.vcxproj: Further improvements.
 
+2017-09-24  Werner Lemberg  <wl@gnu.org>
+
+	[otvalid] Fix handling of ValueRecords.
+
+	For GPOS pair positioning format 1 the description of ValueRecords
+	in the OpenType specification (1.8.2, from today) is wrong – the
+	offset has to be taken from the parent structure; in this case the
+	`PairSet' table.
+
+	* src/otvalid/otvgpos.c (otv_PairSet_validate): Set `extra3'.
+	(otv_PairPos_validate): Adjust.
+
 2017-09-23  Werner Lemberg  <wl@gnu.org>
 
 	[otvalid] Handle `GSUB' and `GPOS' v1.1 tables.
diff --git a/src/otvalid/otvgpos.c b/src/otvalid/otvgpos.c
index 8aede407d..f185b4a0b 100644
--- a/src/otvalid/otvgpos.c
+++ b/src/otvalid/otvgpos.c
@@ -218,10 +218,6 @@
         OTV_LIMIT_CHECK( 2 );
         OTV_OPTIONAL_OFFSET( device );
 
-        /* XXX: this value is usually too small, especially if the current */
-        /* ValueRecord is part of an array -- getting the correct table    */
-        /* size is probably not worth the trouble                          */
-
         table_size = p - otvalid->extra3;
 
         OTV_SIZE_CHECK( device );
@@ -426,6 +422,8 @@
   /*************************************************************************/
   /*************************************************************************/
 
+  /* sets otvalid->extra3 (pointer to base table) */
+
   static void
   otv_PairSet_validate( FT_Bytes       table,
                         FT_UInt        format1,
@@ -438,6 +436,8 @@
 
     OTV_NAME_ENTER( "PairSet" );
 
+    otvalid->extra3 = table;
+
     OTV_LIMIT_CHECK( 2 );
     PairValueCount = FT_NEXT_USHORT( p );
 
@@ -483,8 +483,6 @@
 
     OTV_TRACE(( " (format %d)\n", PosFormat ));
 
-    otvalid->extra3 = table;
-
     switch ( PosFormat )
     {
     case 1:     /* PairPosFormat1 */
@@ -539,6 +537,8 @@
         OTV_LIMIT_CHECK( ClassCount1 * ClassCount2 *
                          ( len_value1 + len_value2 ) );
 
+        otvalid->extra3 = table;
+
         /* Class1Record */
         for ( ; ClassCount1 > 0; ClassCount1-- )
         {