From e7935f29103596751ffda3ee7adea04a0c47050f Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Mon, 18 Dec 2017 07:29:57 +0100
Subject: [PATCH] [truetype] Don't apply HVAR and VVAR deltas twice (#52683).

* src/truetype/ttgload.c (TT_Process_Simple_Glyph): Always adjust
`pp1' to `pp4', except if we have an HVAR and/or VVAR table.

* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Handle
alternative code branch identically w.r.t. presence of an HVAR
and/or VVAR table.
---
 ChangeLog              | 11 +++++++++++
 src/truetype/ttgload.c | 13 +++++++++++++
 src/truetype/ttgxvar.c | 32 ++++++++++++++++++++++++++++++--
 3 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 52a56cbc5..013216edc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2017-12-18  Werner Lemberg  <wl@gnu.org>
+
+	[truetype] Don't apply HVAR and VVAR deltas twice (#52683).
+
+	* src/truetype/ttgload.c (TT_Process_Simple_Glyph): Always adjust
+	`pp1' to `pp4', except if we have an HVAR and/or VVAR table.
+
+	* src/truetype/ttgxvar.c (TT_Vary_Apply_Glyph_Deltas): Handle
+	alternative code branch identically w.r.t. presence of an HVAR
+	and/or VVAR table.
+
 2017-12-17  Jonathan Kew  <jfkthame@gmail.com>
 
 	[truetype] Correctly handle variation font phantom points (#52683).
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 917aa62aa..4b5af854d 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -1037,9 +1037,22 @@
           vec->x = FT_MulFix( vec->x, x_scale );
           vec->y = FT_MulFix( vec->y, y_scale );
         }
+      }
 
+#ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
+      /* if we have a HVAR table, `pp1' and/or `pp2' are already adjusted */
+      if ( !( loader->face->variation_support & TT_FACE_FLAG_VAR_HADVANCE ) )
+#endif
+      {
         loader->pp1 = outline->points[n_points - 4];
         loader->pp2 = outline->points[n_points - 3];
+      }
+
+#ifdef TT_CONFIG_OPTION_GX_VAR_SUPPORT
+      /* if we have a VVAR table, `pp3' and/or `pp4' are already adjusted */
+      if ( !( loader->face->variation_support & TT_FACE_FLAG_VAR_VADVANCE ) )
+#endif
+      {
         loader->pp3 = outline->points[n_points - 2];
         loader->pp4 = outline->points[n_points - 1];
       }
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c
index f490c369d..0d4872f4a 100644
--- a/src/truetype/ttgxvar.c
+++ b/src/truetype/ttgxvar.c
@@ -3725,8 +3725,36 @@
           FT_Pos  delta_y = points_out[j].y - points_org[j].y;
 
 
-          outline->points[j].x += delta_x;
-          outline->points[j].y += delta_y;
+          if ( j < n_points - 4 )
+          {
+            outline->points[j].x += delta_x;
+            outline->points[j].y += delta_y;
+          }
+          else
+          {
+            /* To avoid double adjustment of advance width or height, */
+            /* adjust phantom points only if there is no HVAR or VVAR */
+            /* support, respectively.                                 */
+            if ( j == ( n_points - 4 )        &&
+                 !( face->variation_support &
+                    TT_FACE_FLAG_VAR_LSB    ) )
+              outline->points[j].x += delta_x;
+
+            else if ( j == ( n_points - 3 )          &&
+                      !( face->variation_support   &
+                         TT_FACE_FLAG_VAR_HADVANCE ) )
+              outline->points[j].x += delta_x;
+
+            else if ( j == ( n_points - 2 )        &&
+                      !( face->variation_support &
+                         TT_FACE_FLAG_VAR_TSB    ) )
+              outline->points[j].y += delta_y;
+
+            else if ( j == ( n_points - 1 )          &&
+                      !( face->variation_support   &
+                         TT_FACE_FLAG_VAR_VADVANCE ) )
+              outline->points[j].y += delta_y;
+          }
 
 #ifdef FT_DEBUG_LEVEL_TRACE
           if ( delta_x || delta_y )