sfnt: Cast a charcode to 32-bit in cmap format 14 parser.

builds/atari/ATARI.H

@@ -1,3 +1,7 @@
+#if defined( __GXVALID_H__ )
+#pragma warn -aus /* too many unevaluated variables in gxvalid */
+#endif
+
 #ifndef ATARI_H
 #define ATARI_H
 

include/freetype/config/ftstdlib.h

@@ -61,6 +61,7 @@
 
 #define FT_CHAR_BIT   CHAR_BIT
 #define FT_INT_MAX    INT_MAX
+#define FT_INT_MIN    INT_MIN
 #define FT_UINT_MAX   UINT_MAX
 #define FT_ULONG_MAX  ULONG_MAX
 

include/freetype/fttypes.h

@@ -474,6 +474,7 @@ FT_BEGIN_HEADER
   /*    this macro.                                                        */
   /*                                                                       */
 #define FT_MAKE_TAG( _x1, _x2, _x3, _x4 ) \
+          (FT_Tag)                        \
           ( ( (FT_ULong)_x1 << 24 ) |     \
             ( (FT_ULong)_x2 << 16 ) |     \
             ( (FT_ULong)_x3 <<  8 ) |     \

include/freetype/internal/fttrace.h

@@ -36,11 +36,13 @@ FT_TRACE_DEF( raster )    /* monochrome rasterizer   (ftraster.c) */
 FT_TRACE_DEF( smooth )    /* anti-aliasing raster    (ftgrays.c)  */
 FT_TRACE_DEF( mm )        /* MM interface            (ftmm.c)     */
 FT_TRACE_DEF( raccess )   /* resource fork accessor  (ftrfork.c)  */
+FT_TRACE_DEF( synth )     /* bold/slant synthesizer  (ftsynth.c)  */
 
   /* Cache sub-system */
 FT_TRACE_DEF( cache )     /* cache sub-system        (ftcache.c, etc.) */
 
   /* SFNT driver components */
+FT_TRACE_DEF( sfdriver )  /* SFNT font driver        (sfdriver.c) */
 FT_TRACE_DEF( sfobjs )    /* SFNT object handler     (sfobjs.c)   */
 FT_TRACE_DEF( ttcmap )    /* charmap handler         (ttcmap.c)   */
 FT_TRACE_DEF( ttkern )    /* kerning handler         (ttkern.c)   */

include/freetype/internal/psaux.h

@@ -360,7 +360,7 @@ FT_BEGIN_HEADER
     FT_Error
     (*to_bytes)( PS_Parser  parser,
                  FT_Byte*   bytes,
-                 FT_Long    max_bytes,
+                 FT_Offset  max_bytes,
                  FT_Long*   pnum_bytes,
                  FT_Bool    delimiters );
 
@@ -689,7 +689,7 @@ FT_BEGIN_HEADER
     T1_Decoder_Callback  parse_callback;
     T1_Decoder_FuncsRec  funcs;
 
-    FT_Int*              buildchar;
+    FT_Long*             buildchar;
     FT_UInt              len_buildchar;
 
     FT_Bool              seac;
@@ -755,7 +755,7 @@ FT_BEGIN_HEADER
 
     FT_Int
     (*get_index)( const char*  name,
-                  FT_UInt      len,
+                  FT_Offset    len,
                   void*        user_data );
 
     void*         user_data;

include/freetype/internal/services/svpscmap.h

@@ -98,7 +98,7 @@ FT_BEGIN_HEADER
   (*PS_Unicodes_CharIndexFunc)( PS_Unicodes  unicodes,
                                 FT_UInt32    unicode );
 
-  typedef FT_ULong
+  typedef FT_UInt32
   (*PS_Unicodes_CharNextFunc)( PS_Unicodes  unicodes,
                                FT_UInt32   *unicode );
 

include/freetype/internal/t1types.h

@@ -230,7 +230,7 @@ FT_BEGIN_HEADER
     /* undocumented, optional: has the same meaning as len_buildchar */
     /* for Type 2 fonts; manipulated by othersubrs 19, 24, and 25    */
     FT_UInt          len_buildchar;
-    FT_Int*          buildchar;
+    FT_Long*         buildchar;
 
     /* since version 2.1 - interface to PostScript hinter */
     const void*     pshinter;

include/freetype/internal/tttypes.h

@@ -902,7 +902,7 @@ FT_BEGIN_HEADER
     FT_Byte*   table;
     FT_Byte*   table_end;
     FT_Byte*   strings;
-    FT_UInt32  strings_size;
+    FT_ULong   strings_size;
     FT_UInt    num_strikes;
     FT_Bool    loaded;
 
@@ -1401,7 +1401,7 @@ FT_BEGIN_HEADER
     FT_Byte*              vert_metrics;
     FT_ULong              vert_metrics_size;
 
-    FT_UInt               num_locations;
+    FT_ULong              num_locations; /* in broken TTF, gid > 0xFFFF */ 
     FT_Byte*              glyph_locations;
 
     FT_Byte*              hdmx_table;

src/autofit/afcjk.c

@@ -1020,7 +1020,7 @@
     AF_AxisHints  axis       = &hints->axis[dim];
     AF_Edge       edges      = axis->edges;
     AF_Edge       edge_limit = edges + axis->num_edges;
-    FT_Int        n_edges;
+    FT_PtrDist    n_edges;
     AF_Edge       edge;
     AF_Edge       anchor   = 0;
     FT_Pos        delta    = 0;
@@ -1444,29 +1444,29 @@
   static const AF_Script_UniRangeRec  af_cjk_uniranges[] =
   {
 #if 0
-    {  0x0100UL,  0xFFFFUL },  /* why this? */
+    AF_UNIRANGE_REC(  0x0100UL,  0xFFFFUL ),  /* why this? */
 #endif
-    {  0x2E80UL,  0x2EFFUL },  /* CJK Radicals Supplement                 */
-    {  0x2F00UL,  0x2FDFUL },  /* Kangxi Radicals                         */
-    {  0x3000UL,  0x303FUL },  /* CJK Symbols and Punctuation             */
-    {  0x3040UL,  0x309FUL },  /* Hiragana                                */
-    {  0x30A0UL,  0x30FFUL },  /* Katakana                                */
-    {  0x3100UL,  0x312FUL },  /* Bopomofo                                */
-    {  0x3130UL,  0x318FUL },  /* Hangul Compatibility Jamo               */
-    {  0x31A0UL,  0x31BFUL },  /* Bopomofo Extended                       */
-    {  0x31C0UL,  0x31EFUL },  /* CJK Strokes                             */
-    {  0x31F0UL,  0x31FFUL },  /* Katakana Phonetic Extensions            */
-    {  0x3200UL,  0x32FFUL },  /* Enclosed CJK Letters and Months         */
-    {  0x3300UL,  0x33FFUL },  /* CJK Compatibility                       */
-    {  0x3400UL,  0x4DBFUL },  /* CJK Unified Ideographs Extension A      */
-    {  0x4DC0UL,  0x4DFFUL },  /* Yijing Hexagram Symbols                 */
-    {  0x4E00UL,  0x9FFFUL },  /* CJK Unified Ideographs                  */
-    {  0xF900UL,  0xFAFFUL },  /* CJK Compatibility Ideographs            */
-    {  0xFE30UL,  0xFE4FUL },  /* CJK Compatibility Forms                 */
-    {  0xFF00UL,  0xFFEFUL },  /* Halfwidth and Fullwidth Forms           */
-    { 0x20000UL, 0x2A6DFUL },  /* CJK Unified Ideographs Extension B      */
-    { 0x2F800UL, 0x2FA1FUL },  /* CJK Compatibility Ideographs Supplement */
-    {       0UL,       0UL }
+    AF_UNIRANGE_REC(  0x2E80UL,  0x2EFFUL ),  /* CJK Radicals Supplement                 */
+    AF_UNIRANGE_REC(  0x2F00UL,  0x2FDFUL ),  /* Kangxi Radicals                         */
+    AF_UNIRANGE_REC(  0x3000UL,  0x303FUL ),  /* CJK Symbols and Punctuation             */
+    AF_UNIRANGE_REC(  0x3040UL,  0x309FUL ),  /* Hiragana                                */
+    AF_UNIRANGE_REC(  0x30A0UL,  0x30FFUL ),  /* Katakana                                */
+    AF_UNIRANGE_REC(  0x3100UL,  0x312FUL ),  /* Bopomofo                                */
+    AF_UNIRANGE_REC(  0x3130UL,  0x318FUL ),  /* Hangul Compatibility Jamo               */
+    AF_UNIRANGE_REC(  0x31A0UL,  0x31BFUL ),  /* Bopomofo Extended                       */
+    AF_UNIRANGE_REC(  0x31C0UL,  0x31EFUL ),  /* CJK Strokes                             */
+    AF_UNIRANGE_REC(  0x31F0UL,  0x31FFUL ),  /* Katakana Phonetic Extensions            */
+    AF_UNIRANGE_REC(  0x3200UL,  0x32FFUL ),  /* Enclosed CJK Letters and Months         */
+    AF_UNIRANGE_REC(  0x3300UL,  0x33FFUL ),  /* CJK Compatibility                       */
+    AF_UNIRANGE_REC(  0x3400UL,  0x4DBFUL ),  /* CJK Unified Ideographs Extension A      */
+    AF_UNIRANGE_REC(  0x4DC0UL,  0x4DFFUL ),  /* Yijing Hexagram Symbols                 */
+    AF_UNIRANGE_REC(  0x4E00UL,  0x9FFFUL ),  /* CJK Unified Ideographs                  */
+    AF_UNIRANGE_REC(  0xF900UL,  0xFAFFUL ),  /* CJK Compatibility Ideographs            */
+    AF_UNIRANGE_REC(  0xFE30UL,  0xFE4FUL ),  /* CJK Compatibility Forms                 */
+    AF_UNIRANGE_REC(  0xFF00UL,  0xFFEFUL ),  /* Halfwidth and Fullwidth Forms           */
+    AF_UNIRANGE_REC( 0x20000UL, 0x2A6DFUL ),  /* CJK Unified Ideographs Extension B      */
+    AF_UNIRANGE_REC( 0x2F800UL, 0x2FA1FUL ),  /* CJK Compatibility Ideographs Supplement */
+    AF_UNIRANGE_REC(       0UL,       0UL )
   };
 
 
@@ -1488,7 +1488,7 @@
 
   static const AF_Script_UniRangeRec  af_cjk_uniranges[] =
   {
-    { 0, 0 }
+    AF_UNIRANGE_REC( 0UL, 0UL )
   };
 
 

src/autofit/afglobal.c

@@ -65,7 +65,7 @@
   typedef struct  AF_FaceGlobalsRec_
   {
     FT_Face           face;
-    FT_UInt           glyph_count;    /* same as face->num_glyphs */
+    FT_Long           glyph_count;    /* same as face->num_glyphs */
     FT_Byte*          glyph_scripts;
 
     AF_ScriptMetrics  metrics[AF_SCRIPT_MAX];
@@ -124,7 +124,7 @@
         gindex = FT_Get_Char_Index( face, charcode );
 
         if ( gindex != 0                             &&
-             gindex < globals->glyph_count           &&
+             gindex < (FT_ULong)globals->glyph_count &&
              gscripts[gindex] == AF_SCRIPT_LIST_NONE )
         {
           gscripts[gindex] = (FT_Byte)ss;
@@ -137,7 +137,7 @@
           if ( gindex == 0 || charcode > range->last )
             break;
 
-          if ( gindex < globals->glyph_count           &&
+          if ( gindex < (FT_ULong)globals->glyph_count &&
                gscripts[gindex] == AF_SCRIPT_LIST_NONE )
           {
             gscripts[gindex] = (FT_Byte)ss;
@@ -152,7 +152,7 @@
       FT_UInt  gindex = FT_Get_Char_Index( face, i );
 
 
-      if ( gindex != 0 && gindex < globals->glyph_count )
+      if ( gindex != 0 && gindex < (FT_ULong)globals->glyph_count )
         gscripts[gindex] |= AF_DIGIT;
     }
 
@@ -162,7 +162,7 @@
      *  XXX: Shouldn't we disable hinting or do something similar?
      */
     {
-      FT_UInt  nn;
+      FT_Long  nn;
 
 
       for ( nn = 0; nn < globals->glyph_count; nn++ )
@@ -252,12 +252,12 @@
     FT_UInt           gidx;
     AF_ScriptClass    clazz;
     FT_UInt           script     = options & 15;
-    const FT_UInt     script_max = sizeof ( AF_SCRIPT_CLASSES_GET ) /
+    const FT_Offset   script_max = sizeof ( AF_SCRIPT_CLASSES_GET ) /
                                      sizeof ( AF_SCRIPT_CLASSES_GET[0] );
     FT_Error          error      = AF_Err_Ok;
 
 
-    if ( gindex >= globals->glyph_count )
+    if ( gindex >= (FT_ULong)globals->glyph_count )
     {
       error = AF_Err_Invalid_Argument;
       goto Exit;
@@ -310,7 +310,7 @@
   af_face_globals_is_digit( AF_FaceGlobals  globals,
                             FT_UInt         gindex )
   {
-    if ( gindex < globals->glyph_count )
+    if ( gindex < (FT_ULong)globals->glyph_count )
       return (FT_Bool)( globals->glyph_scripts[gindex] & AF_DIGIT );
 
     return (FT_Bool)0;

src/autofit/afhints.c

@@ -34,7 +34,7 @@
     {
       FT_Int  old_max = axis->max_segments;
       FT_Int  new_max = old_max;
-      FT_Int  big_max = FT_INT_MAX / sizeof ( *segment );
+      FT_Int  big_max = (FT_Int)( FT_INT_MAX / sizeof ( *segment ) );
 
 
       if ( old_max >= big_max )
@@ -77,7 +77,7 @@
     {
       FT_Int  old_max = axis->max_edges;
       FT_Int  new_max = old_max;
-      FT_Int  big_max = FT_INT_MAX / sizeof ( *edge );
+      FT_Int  big_max = (FT_Int)( FT_INT_MAX / sizeof ( *edge ) );
 
 
       if ( old_max >= big_max )
@@ -645,6 +645,7 @@
         FT_Int      contour_index = 0;
 
 
+        FT_UNUSED( first );
         for ( point = points; point < point_limit; point++, vec++, tag++ )
         {
           point->fx = (FT_Short)vec->x;
@@ -940,8 +941,8 @@
         }
 
         {
-          FT_UInt  min, max, mid;
-          FT_Pos   fpos;
+          FT_PtrDist  min, max, mid;
+          FT_Pos      fpos;
 
 
           /* find enclosing edges */
@@ -952,7 +953,7 @@
           /* for small edge counts, a linear search is better */
           if ( max <= 8 )
           {
-            FT_UInt  nn;
+            FT_PtrDist  nn;
 
             for ( nn = 0; nn < max; nn++ )
               if ( edges[nn].fpos >= u )

src/autofit/afindic.c

@@ -81,10 +81,10 @@
   static const AF_Script_UniRangeRec  af_indic_uniranges[] =
   {
 #if 0
-    { 0x0100,  0xFFFF },  /* why this? */
+    AF_UNIRANGE_REC( 0x0100UL, 0xFFFFUL ),  /* why this? */
 #endif
-    { 0x0900, 0x0DFF},    /* Indic Range */
-    { 0,       0 }
+    AF_UNIRANGE_REC( 0x0900UL, 0x0DFFUL),    /* Indic Range */
+    AF_UNIRANGE_REC(      0UL,      0UL)
   };
 
 

src/autofit/aflatin.c

@@ -198,7 +198,8 @@
       for ( ; p < limit && *p; p++ )
       {
         FT_UInt     glyph_index;
-        FT_Int      best_point, best_y, best_first, best_last;
+        FT_Pos      best_y; /* same as points.y */
+        FT_Int      best_point, best_first, best_last;
         FT_Vector*  points;
         FT_Bool     round = 0;
 
@@ -1617,7 +1618,7 @@
             /* not hinted, appear a lot bolder or thinner than the    */
             /* vertical stems.                                        */
 
-            FT_Int  delta;
+            FT_Pos  delta;
 
 
             dist = ( dist + 22 ) & ~63;
@@ -1701,7 +1702,7 @@
     AF_AxisHints  axis       = &hints->axis[dim];
     AF_Edge       edges      = axis->edges;
     AF_Edge       edge_limit = edges + axis->num_edges;
-    FT_Int        n_edges;
+    FT_PtrDist    n_edges;
     AF_Edge       edge;
     AF_Edge       anchor     = 0;
     FT_Int        has_serifs = 0;
@@ -2177,33 +2178,33 @@
 
   static const AF_Script_UniRangeRec  af_latin_uniranges[] =
   {
-    {  0x0020  ,  0x007F   },  /* Basic Latin (no control chars) */
-    {  0x00A0  ,  0x00FF   },  /* Latin-1 Supplement (no control chars) */
-    {  0x0100  ,  0x017F   },  /* Latin Extended-A */
-    {  0x0180  ,  0x024F   },  /* Latin Extended-B */
-    {  0x0250  ,  0x02AF   },  /* IPA Extensions */
-    {  0x02B0  ,  0x02FF   },  /* Spacing Modifier Letters */
-    {  0x0300  ,  0x036F   },  /* Combining Diacritical Marks */
-    {  0x0370  ,  0x03FF   },  /* Greek and Coptic */
-    {  0x0400  ,  0x04FF   },  /* Cyrillic */
-    {  0x0500  ,  0x052F   },  /* Cyrillic Supplement */
-    {  0x1D00  ,  0x1D7F   },  /* Phonetic Extensions */
-    {  0x1D80  ,  0x1DBF   },  /* Phonetic Extensions Supplement */
-    {  0x1DC0  ,  0x1DFF   },  /* Combining Diacritical Marks Supplement */
-    {  0x1E00  ,  0x1EFF   },  /* Latin Extended Additional */
-    {  0x1F00  ,  0x1FFF   },  /* Greek Extended */
-    {  0x2000  ,  0x206F   },  /* General Punctuation */
-    {  0x2070  ,  0x209F   },  /* Superscripts and Subscripts */
-    {  0x20A0  ,  0x20CF   },  /* Currency Symbols */
-    {  0x2150  ,  0x218F   },  /* Number Forms */
-    {  0x2460  ,  0x24FF   },  /* Enclosed Alphanumerics */
-    {  0x2C60  ,  0x2C7F   },  /* Latin Extended-C */
-    {  0x2DE0  ,  0x2DFF   },  /* Cyrillic Extended-A */
-    {  0xA640U ,  0xA69FU  },  /* Cyrillic Extended-B */
-    {  0xA720U ,  0xA7FFU  },  /* Latin Extended-D */
-    {  0xFB00U ,  0xFB06U  },  /* Alphab. Present. Forms (Latin Ligs) */
-    { 0x1D400UL, 0x1D7FFUL },  /* Mathematical Alphanumeric Symbols */
-    { 0        , 0         }
+    AF_UNIRANGE_REC(  0x0020UL,  0x007FUL ),  /* Basic Latin (no control chars) */
+    AF_UNIRANGE_REC(  0x00A0UL,  0x00FFUL ),  /* Latin-1 Supplement (no control chars) */
+    AF_UNIRANGE_REC(  0x0100UL,  0x017FUL ),  /* Latin Extended-A */
+    AF_UNIRANGE_REC(  0x0180UL,  0x024FUL ),  /* Latin Extended-B */
+    AF_UNIRANGE_REC(  0x0250UL,  0x02AFUL ),  /* IPA Extensions */
+    AF_UNIRANGE_REC(  0x02B0UL,  0x02FFUL ),  /* Spacing Modifier Letters */
+    AF_UNIRANGE_REC(  0x0300UL,  0x036FUL ),  /* Combining Diacritical Marks */
+    AF_UNIRANGE_REC(  0x0370UL,  0x03FFUL ),  /* Greek and Coptic */
+    AF_UNIRANGE_REC(  0x0400UL,  0x04FFUL ),  /* Cyrillic */
+    AF_UNIRANGE_REC(  0x0500UL,  0x052FUL ),  /* Cyrillic Supplement */
+    AF_UNIRANGE_REC(  0x1D00UL,  0x1D7FUL ),  /* Phonetic Extensions */
+    AF_UNIRANGE_REC(  0x1D80UL,  0x1DBFUL ),  /* Phonetic Extensions Supplement */
+    AF_UNIRANGE_REC(  0x1DC0UL,  0x1DFFUL ),  /* Combining Diacritical Marks Supplement */
+    AF_UNIRANGE_REC(  0x1E00UL,  0x1EFFUL ),  /* Latin Extended Additional */
+    AF_UNIRANGE_REC(  0x1F00UL,  0x1FFFUL ),  /* Greek Extended */
+    AF_UNIRANGE_REC(  0x2000UL,  0x206FUL ),  /* General Punctuation */
+    AF_UNIRANGE_REC(  0x2070UL,  0x209FUL ),  /* Superscripts and Subscripts */
+    AF_UNIRANGE_REC(  0x20A0UL,  0x20CFUL ),  /* Currency Symbols */
+    AF_UNIRANGE_REC(  0x2150UL,  0x218FUL ),  /* Number Forms */
+    AF_UNIRANGE_REC(  0x2460UL,  0x24FFUL ),  /* Enclosed Alphanumerics */
+    AF_UNIRANGE_REC(  0x2C60UL,  0x2C7FUL ),  /* Latin Extended-C */
+    AF_UNIRANGE_REC(  0x2DE0UL,  0x2DFFUL ),  /* Cyrillic Extended-A */
+    AF_UNIRANGE_REC(  0xA640UL,  0xA69FUL ),  /* Cyrillic Extended-B */
+    AF_UNIRANGE_REC(  0xA720UL,  0xA7FFUL ),  /* Latin Extended-D */
+    AF_UNIRANGE_REC(  0xFB00UL,  0xFB06UL ),  /* Alphab. Present. Forms (Latin Ligs) */
+    AF_UNIRANGE_REC( 0x1D400UL, 0x1D7FFUL ),  /* Mathematical Alphanumeric Symbols */
+    AF_UNIRANGE_REC(       0UL,       0UL )
   };
 
 

src/autofit/aflatin2.c

@@ -2320,9 +2320,9 @@
 
   static const AF_Script_UniRangeRec  af_latin2_uniranges[] =
   {
-    { 32,  127 },    /* XXX: TODO: Add new Unicode ranges here! */
-    { 160, 255 },
-    { 0,   0 }
+    AF_UNIRANGE_REC( 32UL,  127UL ),    /* XXX: TODO: Add new Unicode ranges here! */
+    AF_UNIRANGE_REC( 160UL, 255UL ),
+    AF_UNIRANGE_REC( 0UL,   0UL )
   };
 
 

src/autofit/aftypes.h

@@ -322,6 +322,8 @@ extern void*  _af_debug_hints;
 
   } AF_Script_UniRangeRec;
 
+#define AF_UNIRANGE_REC( a, b ) { (FT_UInt32)(a), (FT_UInt32)(b) }
+
   typedef const AF_Script_UniRangeRec  *AF_Script_UniRange;
 
 
@@ -330,7 +332,7 @@ extern void*  _af_debug_hints;
     AF_Script                   script;
     AF_Script_UniRange          script_uni_ranges; /* last must be { 0, 0 } */
 
-    FT_UInt                     script_metrics_size;
+    FT_Offset                   script_metrics_size;
     AF_Script_InitMetricsFunc   script_metrics_init;
     AF_Script_ScaleMetricsFunc  script_metrics_scale;
     AF_Script_DoneMetricsFunc   script_metrics_done;

src/base/ftadvanc.c

@@ -140,7 +140,7 @@
     if ( flags & FT_ADVANCE_FLAG_FAST_ONLY )
       return FT_Err_Unimplemented_Feature;
 
-    flags |= FT_LOAD_ADVANCE_ONLY;
+    flags |= (FT_UInt32)FT_LOAD_ADVANCE_ONLY;
     for ( nn = 0; nn < count; nn++ )
     {
       error = FT_Load_Glyph( face, start + nn, flags );

src/base/ftbitmap.c

@@ -228,8 +228,12 @@
     if ( !bitmap || !bitmap->buffer )
       return FT_Err_Invalid_Argument;
 
-    xstr = FT_PIX_ROUND( xStrength ) >> 6;
-    ystr = FT_PIX_ROUND( yStrength ) >> 6;
+    if ( ( ( FT_PIX_ROUND( xStrength ) >> 6 ) > FT_INT_MAX ) ||
+         ( ( FT_PIX_ROUND( yStrength ) >> 6 ) > FT_INT_MAX ) )
+      return FT_Err_Invalid_Argument;
+       
+    xstr = (FT_Int)FT_PIX_ROUND( xStrength ) >> 6;
+    ystr = (FT_Int)FT_PIX_ROUND( yStrength ) >> 6;
 
     if ( xstr == 0 && ystr == 0 )
       return FT_Err_Ok;

src/base/ftcalc.c

@@ -110,12 +110,12 @@
   FT_EXPORT_DEF( FT_Int32 )
   FT_Sqrt32( FT_Int32  x )
   {
-    FT_ULong  val, root, newroot, mask;
+    FT_UInt32  val, root, newroot, mask;
 
 
     root = 0;
-    mask = 0x40000000L;
-    val  = (FT_ULong)x;
+    mask = (FT_UInt32)0x40000000UL;
+    val  = (FT_UInt32)x;
 
     do
     {
@@ -362,6 +362,7 @@
     long  s;
 
 
+    /* XXX: this function does not allow 64-bit arguments */
     if ( a == 0 || b == c )
       return a;
 
@@ -377,12 +378,12 @@
       FT_Int64  temp, temp2;
 
 
-      ft_multo64( a, b, &temp );
+      ft_multo64( (FT_Int32)a, (FT_Int32)b, &temp );
 
       temp2.hi = 0;
       temp2.lo = (FT_UInt32)(c >> 1);
       FT_Add64( &temp, &temp2, &temp );
-      a = ft_div64by32( temp.hi, temp.lo, c );
+      a = ft_div64by32( temp.hi, temp.lo, (FT_Int32)c );
     }
     else
       a = 0x7FFFFFFFL;
@@ -416,8 +417,8 @@
       FT_Int64  temp;
 
 
-      ft_multo64( a, b, &temp );
-      a = ft_div64by32( temp.hi, temp.lo, c );
+      ft_multo64( (FT_Int32)a, (FT_Int32)b, &temp );
+      a = ft_div64by32( temp.hi, temp.lo, (FT_Int32)c );
     }
     else
       a = 0x7FFFFFFFL;
@@ -539,13 +540,14 @@
     FT_UInt32  q;
 
 
-    s  = a; a = FT_ABS( a );
-    s ^= b; b = FT_ABS( b );
+    /* XXX: this function does not allow 64-bit arguments */
+    s  = (FT_Int32)a; a = FT_ABS( a );
+    s ^= (FT_Int32)b; b = FT_ABS( b );
 
     if ( b == 0 )
     {
       /* check for division by 0 */
-      q = 0x7FFFFFFFL;
+      q = (FT_UInt32)0x7FFFFFFFL;
     }
     else if ( ( a >> 16 ) == 0 )
     {
@@ -562,7 +564,7 @@
       temp2.hi = 0;
       temp2.lo = (FT_UInt32)( b >> 1 );
       FT_Add64( &temp, &temp2, &temp );
-      q = ft_div64by32( temp.hi, temp.lo, b );
+      q = ft_div64by32( temp.hi, temp.lo, (FT_Int32)b );
     }
 
     return ( s < 0 ? -(FT_Int32)q : (FT_Int32)q );
@@ -840,7 +842,7 @@
                          FT_Pos  out_x,
                          FT_Pos  out_y )
   {
-    FT_Int  result;
+    FT_Long  result; /* avoid overflow on 16-bit system */
 
 
     /* deal with the trivial cases quickly */
@@ -889,8 +891,9 @@
       FT_Int64  z1, z2;
 
 
-      ft_multo64( in_x, out_y, &z1 );
-      ft_multo64( in_y, out_x, &z2 );
+      /* XXX: this function does not allow 64-bit arguments */
+      ft_multo64( (FT_Int32)in_x, (FT_Int32)out_y, &z1 );
+      ft_multo64( (FT_Int32)in_y, (FT_Int32)out_x, &z2 );
 
       if ( z1.hi > z2.hi )
         result = +1;
@@ -906,7 +909,8 @@
 #endif
     }
 
-    return result;
+    /* XXX: only the sign of return value, +1/0/-1 must be used */
+    return (FT_Int)result;
   }
 
 

src/base/ftglyph.c

@@ -507,7 +507,6 @@
                       FT_Vector*      origin,
                       FT_Bool         destroy )
   {
-    FT_Library                library;
     FT_GlyphSlotRec           dummy;
     FT_GlyphSlot_InternalRec  dummy_internal;
     FT_Error                  error = FT_Err_Ok;
@@ -528,7 +527,6 @@
     if ( !glyph )
       goto Bad;
 
-    library = glyph->library;
     clazz = glyph->clazz;
 
     /* when called with a bitmap glyph, do nothing and return successfully */

src/base/ftobjs.c

@@ -3054,7 +3054,12 @@
       FT_CMap  cmap = FT_CMAP( face->charmap );
 
 
-      result = cmap->clazz->char_index( cmap, charcode );
+      if ( charcode > 0xFFFFFFFFUL )
+      {
+        FT_TRACE1(( "FT_Get_Char_Index: too large charcode" ));
+        FT_TRACE1(( " 0x%x is truncated\n", charcode ));
+      }
+      result = cmap->clazz->char_index( cmap, (FT_UInt32)charcode );
     }
     return  result;
   }
@@ -3134,8 +3139,20 @@
         FT_CMap  vcmap = FT_CMAP( charmap );
 
 
-        result = vcmap->clazz->char_var_index( vcmap, ucmap, charcode,
-                                               variantSelector );
+        if ( charcode > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large charcode" ));
+          FT_TRACE1(( " 0x%x is truncated\n", charcode ));
+        }
+        if ( variantSelector > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large variantSelector" ));
+          FT_TRACE1(( " 0x%x is truncated\n", variantSelector ));
+        }
+
+        result = vcmap->clazz->char_var_index( vcmap, ucmap,
+                                               (FT_UInt32)charcode,
+                                               (FT_UInt32)variantSelector );
       }
     }
 
@@ -3163,8 +3180,20 @@
         FT_CMap  vcmap = FT_CMAP( charmap );
 
 
-        result = vcmap->clazz->char_var_default( vcmap, charcode,
-                                                 variantSelector );
+        if ( charcode > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large charcode" ));
+          FT_TRACE1(( " 0x%x is truncated\n", charcode ));
+        }
+        if ( variantSelector > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large variantSelector" ));
+          FT_TRACE1(( " 0x%x is truncated\n", variantSelector ));
+        }
+
+        result = vcmap->clazz->char_var_default( vcmap,
+                                                 (FT_UInt32)charcode,
+                                                 (FT_UInt32)variantSelector );
       }
     }
 
@@ -3219,7 +3248,14 @@
         FT_Memory  memory = FT_FACE_MEMORY( face );
 
 
-        result = vcmap->clazz->charvariant_list( vcmap, memory, charcode );
+        if ( charcode > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large charcode" ));
+          FT_TRACE1(( " 0x%x is truncated\n", charcode ));
+        }
+
+        result = vcmap->clazz->charvariant_list( vcmap, memory,
+                                                 (FT_UInt32)charcode );
       }
     }
     return result;
@@ -3246,8 +3282,14 @@
         FT_Memory  memory = FT_FACE_MEMORY( face );
 
 
+        if ( variantSelector > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "FT_Get_Char_Index: too large variantSelector" ));
+          FT_TRACE1(( " 0x%x is truncated\n", variantSelector ));
+        }
+
         result = vcmap->clazz->variantchar_list( vcmap, memory,
-                                                 variantSelector );
+                                                 (FT_UInt32)variantSelector );
       }
     }
 
@@ -3297,7 +3339,7 @@
       ((FT_Byte*)buffer)[0] = 0;
 
     if ( face                                     &&
-         glyph_index <= (FT_UInt)face->num_glyphs &&
+         (FT_Long)glyph_index <= face->num_glyphs &&
          FT_HAS_GLYPH_NAMES( face )               )
     {
       FT_Service_GlyphDict  service;

src/base/ftpatent.c

@@ -103,6 +103,7 @@
     }
 
   Exit:
+    FT_UNUSED( error );
     FT_FRAME_EXIT();
     return result;
   }

src/base/ftrfork.c

@@ -752,9 +752,9 @@
                           const char  *insertion )
   {
     char*        new_name;
-    char*        tmp;
+    const char*  tmp;
     const char*  slash;
-    unsigned     new_length;
+    size_t       new_length;
     FT_Error     error = FT_Err_Ok;
 
     FT_UNUSED( error );

src/base/ftsynth.c

@@ -18,11 +18,21 @@
 
 #include <ft2build.h>
 #include FT_SYNTHESIS_H
+#include FT_INTERNAL_DEBUG_H
 #include FT_INTERNAL_OBJECTS_H
 #include FT_OUTLINE_H
 #include FT_BITMAP_H
 
 
+  /*************************************************************************/
+  /*                                                                       */
+  /* The macro FT_COMPONENT is used in trace mode.  It is an implicit      */
+  /* parameter of the FT_TRACE() and FT_ERROR() macros, used to print/log  */
+  /* messages during execution.                                            */
+  /*                                                                       */
+#undef  FT_COMPONENT
+#define FT_COMPONENT  trace_synth
+
   /*************************************************************************/
   /*************************************************************************/
   /****                                                                 ****/
@@ -106,6 +116,18 @@
         xstr = 1 << 6;
       ystr &= ~63;
 
+      /*
+       * XXX: overflow check for 16-bit system, for compatibility
+       *      with FT_GlyphSlot_Embolden() since freetype-2.1.10.
+       *      unfortunately, this function return no informations
+       *      about the cause of error.
+       */
+      if ( ( ystr >> 6 ) > FT_INT_MAX || ( ystr >> 6 ) < FT_INT_MIN )
+      {
+        FT_TRACE1(( "FT_GlyphSlot_Embolden:" ));
+        FT_TRACE1(( "too strong embolding parameter ystr=%d\n", ystr ));
+        return;
+      }
       error = FT_GlyphSlot_Own_Bitmap( slot );
       if ( error )
         return;
@@ -129,8 +151,9 @@
     slot->metrics.vertBearingY += ystr;
     slot->metrics.vertAdvance  += ystr;
 
+    /* XXX: 16-bit overflow case must be excluded before here */
     if ( slot->format == FT_GLYPH_FORMAT_BITMAP )
-      slot->bitmap_top += ystr >> 6;
+      slot->bitmap_top += (FT_Int)( ystr >> 6 );
   }
 
 

src/base/fttrigon.c

@@ -72,10 +72,10 @@
     val = ( val >= 0 ) ? val : -val;
 
     v1 = (FT_UInt32)val >> 16;
-    v2 = (FT_UInt32)val & 0xFFFFL;
+    v2 = (FT_UInt32)(val & 0xFFFFL);
 
-    k1 = FT_TRIG_SCALE >> 16;       /* constant */
-    k2 = FT_TRIG_SCALE & 0xFFFFL;   /* constant */
+    k1 = (FT_UInt32)FT_TRIG_SCALE >> 16;       /* constant */
+    k2 = (FT_UInt32)(FT_TRIG_SCALE & 0xFFFFL);   /* constant */
 
     hi   = k1 * v1;
     lo1  = k1 * v2 + k2 * v1;       /* can't overflow */
@@ -86,7 +86,7 @@
 
     hi  += lo1 >> 16;
     if ( lo1 < lo3 )
-      hi += 0x10000UL;
+      hi += (FT_UInt32)0x10000UL;
 
     val  = (FT_Fixed)hi;
 
@@ -433,7 +433,7 @@
 
       if ( shift > 0 )
       {
-        FT_Int32  half = 1L << ( shift - 1 );
+        FT_Int32  half = (FT_Int32)1L << ( shift - 1 );
 
 
         vec->x = ( v.x + half + FT_SIGN_LONG( v.x ) ) >> shift;

src/bdf/bdf.h

@@ -114,8 +114,8 @@ FT_BEGIN_HEADER
     union
     {
       char*          atom;
-      long           int32;
-      unsigned long  card32;
+      long           l;
+      unsigned long  ul;
 
     } value;             /* Value of the property.  */
 

src/bdf/bdfdrivr.c

@@ -53,7 +53,7 @@ THE SOFTWARE.
   typedef struct  BDF_CMapRec_
   {
     FT_CMapRec        cmap;
-    FT_UInt           num_encodings;
+    FT_ULong          num_encodings; /* ftobjs.h: FT_CMap->clazz->size */
     BDF_encoding_el*  encodings;
 
   } BDF_CMapRec, *BDF_CMap;
@@ -92,8 +92,8 @@ THE SOFTWARE.
   {
     BDF_CMap          cmap      = (BDF_CMap)bdfcmap;
     BDF_encoding_el*  encodings = cmap->encodings;
-    FT_UInt           min, max, mid;
-    FT_UInt           result    = 0;
+    FT_ULong          min, max, mid; /* num_encodings */
+    FT_UShort         result    = 0; /* encodings->glyph */
 
 
     min = 0;
@@ -101,7 +101,7 @@ THE SOFTWARE.
 
     while ( min < max )
     {
-      FT_UInt32  code;
+      FT_ULong  code;
 
 
       mid  = ( min + max ) >> 1;
@@ -131,9 +131,9 @@ THE SOFTWARE.
   {
     BDF_CMap          cmap      = (BDF_CMap)bdfcmap;
     BDF_encoding_el*  encodings = cmap->encodings;
-    FT_UInt           min, max, mid;
-    FT_UInt32         charcode = *acharcode + 1;
-    FT_UInt           result   = 0;
+    FT_ULong          min, max, mid; /* num_encodings */
+    FT_UShort         result   = 0;  /* encodings->glyph */
+    FT_ULong          charcode = *acharcode + 1;
 
 
     min = 0;
@@ -141,7 +141,7 @@ THE SOFTWARE.
 
     while ( min < max )
     {
-      FT_UInt32  code;
+      FT_ULong  code; /* same as BDF_encoding_el.enc */
 
 
       mid  = ( min + max ) >> 1;
@@ -169,7 +169,14 @@ THE SOFTWARE.
     }
 
   Exit:
-    *acharcode = charcode;
+    if ( charcode > 0xFFFFFFFFUL )
+    {
+      FT_TRACE1(( "bdf_cmap_char_next: charcode 0x%x > 32bit API" ));
+      *acharcode = 0;
+      /* XXX: result should be changed to indicate an overflow error */
+    }
+    else
+      *acharcode = (FT_UInt32)charcode;
     return result;
   }
 
@@ -196,9 +203,8 @@ THE SOFTWARE.
     bdf_font_t*      font   = bdf->bdffont;
     bdf_property_t*  prop;
 
-    int    nn, len;
-    char*  strings[4] = { NULL, NULL, NULL, NULL };
-    int    lengths[4];
+    char*   strings[4] = { NULL, NULL, NULL, NULL };
+    size_t  nn, len, lengths[4];
 
 
     face->style_flags = 0;
@@ -284,7 +290,7 @@ THE SOFTWARE.
         /* add_style_name and setwidth_name     */
         if ( nn == 0 || nn == 3 )
         {
-          int  mm;
+          size_t  mm;
 
 
           for ( mm = 0; mm < len; mm++ )
@@ -426,7 +432,7 @@ THE SOFTWARE.
 
         prop = bdf_get_font_property( font, "AVERAGE_WIDTH" );
         if ( prop )
-          bsize->width = (FT_Short)( ( prop->value.int32 + 5 ) / 10 );
+          bsize->width = (FT_Short)( ( prop->value.l + 5 ) / 10 );
         else
           bsize->width = (FT_Short)( bsize->height * 2/3 );
 
@@ -434,21 +440,21 @@ THE SOFTWARE.
         if ( prop )
           /* convert from 722.7 decipoints to 72 points per inch */
           bsize->size =
-            (FT_Pos)( ( prop->value.int32 * 64 * 7200 + 36135L ) / 72270L );
+            (FT_Pos)( ( prop->value.l * 64 * 7200 + 36135L ) / 72270L );
         else
           bsize->size = bsize->width << 6;
 
         prop = bdf_get_font_property( font, "PIXEL_SIZE" );
         if ( prop )
-          bsize->y_ppem = (FT_Short)prop->value.int32 << 6;
+          bsize->y_ppem = (FT_Short)prop->value.l << 6;
 
         prop = bdf_get_font_property( font, "RESOLUTION_X" );
         if ( prop )
-          resolution_x = (FT_Short)prop->value.int32;
+          resolution_x = (FT_Short)prop->value.l;
 
         prop = bdf_get_font_property( font, "RESOLUTION_Y" );
         if ( prop )
-          resolution_y = (FT_Short)prop->value.int32;
+          resolution_y = (FT_Short)prop->value.l;
 
         if ( bsize->y_ppem == 0 )
         {
@@ -479,7 +485,12 @@ THE SOFTWARE.
           (face->en_table[n]).glyph = (FT_Short)n;
 
           if ( cur[n].encoding == font->default_char )
-            face->default_glyph = n;
+          {
+            if ( n < FT_UINT_MAX )
+              face->default_glyph = (FT_UInt)n;
+            else
+              FT_TRACE1(( "idx %d is too large for this system\n", n ));
+          }
         }
       }
 
@@ -671,7 +682,10 @@ THE SOFTWARE.
 
     bitmap->rows  = glyph.bbx.height;
     bitmap->width = glyph.bbx.width;
-    bitmap->pitch = glyph.bpr;
+    if ( glyph.bpr > INT_MAX )
+      FT_TRACE1(( "BDF_Glyph_Load: too large pitch %d is truncated\n",
+                   glyph.bpr ));
+    bitmap->pitch = (int)glyph.bpr; /* same as FT_Bitmap.pitch */
 
     /* note: we don't allocate a new array to hold the bitmap; */
     /*       we can simply point to it                         */
@@ -743,13 +757,23 @@ THE SOFTWARE.
         break;
 
       case BDF_INTEGER:
+        if ( prop->value.l > 0x7FFFFFFFL || prop->value.l < ( -1 - 0x7FFFFFFFL ) )
+        {
+          FT_TRACE1(( "bdf_get_bdf_property: " ));
+          FT_TRACE1(( "too large integer 0x%x is truncated\n" ));
+        }
         aproperty->type      = BDF_PROPERTY_TYPE_INTEGER;
-        aproperty->u.integer = prop->value.int32;
+        aproperty->u.integer = (FT_Int32)prop->value.l;
         break;
 
       case BDF_CARDINAL:
+        if ( prop->value.ul > 0xFFFFFFFFUL )
+        {
+          FT_TRACE1(( "bdf_get_bdf_property: " ));
+          FT_TRACE1(( "too large cardinal 0x%x is truncated\n" ));
+        }
         aproperty->type       = BDF_PROPERTY_TYPE_CARDINAL;
-        aproperty->u.cardinal = prop->value.card32;
+        aproperty->u.cardinal = (FT_UInt32)prop->value.ul;
         break;
 
       default:

src/bdf/bdflib.c

@@ -415,18 +415,18 @@
 
 
   static FT_Error
-  _bdf_list_ensure( _bdf_list_t*  list,
-                    int           num_items )
+  _bdf_list_ensure( _bdf_list_t*   list,
+                    unsigned long  num_items ) /* same as _bdf_list_t.used */
   {
     FT_Error  error = BDF_Err_Ok;
 
 
-    if ( num_items > (int)list->size )
+    if ( num_items > list->size )
     {
-      int        oldsize = list->size;
-      int        newsize = oldsize + ( oldsize >> 1 ) + 4;
-      int        bigsize = FT_INT_MAX / sizeof ( char* );
-      FT_Memory  memory  = list->memory;
+      unsigned long  oldsize = list->size; /* same as _bdf_list_t.size */
+      unsigned long  newsize = oldsize + ( oldsize >> 1 ) + 4;
+      unsigned long  bigsize = (unsigned long)( FT_INT_MAX / sizeof ( char* ) );
+      FT_Memory      memory  = list->memory;
 
 
       if ( oldsize == bigsize )
@@ -614,8 +614,8 @@
   {
     _bdf_line_func_t  cb;
     unsigned long     lineno, buf_size;
-    int               refill, bytes, hold, to_skip;
-    int               start, end, cursor, avail;
+    int               refill, hold, to_skip;
+    ptrdiff_t         bytes, start, end, cursor, avail;
     char*             buf = 0;
     FT_Memory         memory = stream->memory;
     FT_Error          error = BDF_Err_Ok;
@@ -648,8 +648,8 @@
     {
       if ( refill )
       {
-        bytes  = (int)FT_Stream_TryRead( stream, (FT_Byte*)buf + cursor,
-                                         (FT_ULong)(buf_size - cursor) );
+        bytes  = (ptrdiff_t)FT_Stream_TryRead( stream, (FT_Byte*)buf + cursor,
+                                               (FT_ULong)(buf_size - cursor) );
         avail  = cursor + bytes;
         cursor = 0;
         refill = 0;
@@ -1289,11 +1289,11 @@
         break;
 
       case BDF_INTEGER:
-        fp->value.int32 = _bdf_atol( value, 0, 10 );
+        fp->value.l = _bdf_atol( value, 0, 10 );
         break;
 
       case BDF_CARDINAL:
-        fp->value.card32 = _bdf_atoul( value, 0, 10 );
+        fp->value.ul = _bdf_atoul( value, 0, 10 );
         break;
 
       default:
@@ -1359,11 +1359,11 @@
       break;
 
     case BDF_INTEGER:
-      fp->value.int32 = _bdf_atol( value, 0, 10 );
+      fp->value.l = _bdf_atol( value, 0, 10 );
       break;
 
     case BDF_CARDINAL:
-      fp->value.card32 = _bdf_atoul( value, 0, 10 );
+      fp->value.ul = _bdf_atoul( value, 0, 10 );
       break;
     }
 
@@ -1387,11 +1387,11 @@
     /* present, and the SPACING property should override the default       */
     /* spacing.                                                            */
     if ( ft_memcmp( name, "DEFAULT_CHAR", 12 ) == 0 )
-      font->default_char = fp->value.int32;
+      font->default_char = fp->value.l;
     else if ( ft_memcmp( name, "FONT_ASCENT", 11 ) == 0 )
-      font->font_ascent = fp->value.int32;
+      font->font_ascent = fp->value.l;
     else if ( ft_memcmp( name, "FONT_DESCENT", 12 ) == 0 )
-      font->font_descent = fp->value.int32;
+      font->font_descent = fp->value.l;
     else if ( ft_memcmp( name, "SPACING", 7 ) == 0 )
     {
       if ( !fp->value.atom )

src/cache/ftcbasic.c

@@ -25,6 +25,8 @@
 #include "ftccback.h"
 #include "ftcerror.h"
 
+#define FT_COMPONENT  trace_cache
+
 
 #ifdef FT_CONFIG_OPTION_OLD_INTERNALS
 
@@ -139,8 +141,15 @@
 
     error = FTC_Manager_LookupFace( manager, family->attrs.scaler.face_id,
                                     &face );
+
+    if ( (FT_ULong)face->num_glyphs > FT_UINT_MAX || 0 > face->num_glyphs )
+    {
+      FT_TRACE1(( "ftc_basic_family_get_count: too large number of glyphs " ));
+      FT_TRACE1(( "in this face, truncated\n", face->num_glyphs ));
+    }
+
     if ( !error )
-      result = face->num_glyphs;
+      result = (FT_UInt)face->num_glyphs;
 
     return result;
   }
@@ -319,13 +328,13 @@
     if ( anode )
       *anode  = NULL;
 
-#ifdef FT_CONFIG_OPTION_OLD_INTERNALS
+#if defined( FT_CONFIG_OPTION_OLD_INTERNALS ) && ( FT_INT_MAX > 0xFFFFU )
 
     /*
      *  This one is a major hack used to detect whether we are passed a
      *  regular FTC_ImageType handle, or a legacy FTC_OldImageDesc one.
      */
-    if ( type->width >= 0x10000 )
+    if ( (FT_ULong)type->width >= 0x10000L )
     {
       FTC_OldImageDesc  desc = (FTC_OldImageDesc)type;
 
@@ -340,10 +349,16 @@
 #endif /* FT_CONFIG_OPTION_OLD_INTERNALS */
 
     {
+      if ( (FT_ULong)(type->flags - FT_INT_MIN) > FT_UINT_MAX )
+      {
+        FT_TRACE1(( "FTC_ImageCache_Lookup: higher bits in load_flags" ));
+        FT_TRACE1(( "0x%x are dropped\n", (type->flags & ~((FT_ULong)FT_UINT_MAX)) ));
+      }
+
       query.attrs.scaler.face_id = type->face_id;
       query.attrs.scaler.width   = type->width;
       query.attrs.scaler.height  = type->height;
-      query.attrs.load_flags     = type->flags;
+      query.attrs.load_flags     = (FT_UInt)type->flags;
     }
 
     query.attrs.scaler.pixel = 1;
@@ -409,8 +424,15 @@
     if ( anode )
       *anode  = NULL;
 
+    /* FT_Load_Glyph(), FT_Load_Char() take FT_UInt flags */
+    if ( load_flags > FT_UINT_MAX )
+    {
+      FT_TRACE1(( "FTC_ImageCache_LookupScaler: higher bits in load_flags" ));
+      FT_TRACE1(( "0x%x are dropped\n", (load_flags & ~((FT_ULong)FT_UINT_MAX)) ));
+    }
+
     query.attrs.scaler     = scaler[0];
-    query.attrs.load_flags = load_flags;
+    query.attrs.load_flags = (FT_UInt)load_flags;
 
     hash = FTC_BASIC_ATTR_HASH( &query.attrs ) + gindex;
 
@@ -642,12 +664,12 @@
 
     *ansbit = NULL;
 
-#ifdef FT_CONFIG_OPTION_OLD_INTERNALS
+#if defined( FT_CONFIG_OPTION_OLD_INTERNALS ) && ( FT_INT_MAX > 0xFFFFU )
 
     /*  This one is a major hack used to detect whether we are passed a
      *  regular FTC_ImageType handle, or a legacy FTC_OldImageDesc one.
      */
-    if ( type->width >= 0x10000 )
+    if ( (FT_ULong)type->width >= 0x10000L )
     {
       FTC_OldImageDesc  desc = (FTC_OldImageDesc)type;
 
@@ -662,10 +684,16 @@
 #endif /* FT_CONFIG_OPTION_OLD_INTERNALS */
 
     {
+      if ( (FT_ULong)(type->flags - FT_INT_MIN) > FT_UINT_MAX )
+      {
+        FT_TRACE1(( "FTC_ImageCache_Lookup: higher bits in load_flags" ));
+        FT_TRACE1(( "0x%x are dropped\n", (type->flags & ~((FT_ULong)FT_UINT_MAX)) ));
+      }
+
       query.attrs.scaler.face_id = type->face_id;
       query.attrs.scaler.width   = type->width;
       query.attrs.scaler.height  = type->height;
-      query.attrs.load_flags     = type->flags;
+      query.attrs.load_flags     = (FT_UInt)type->flags;
     }
 
     query.attrs.scaler.pixel = 1;
@@ -732,8 +760,15 @@
 
     *ansbit = NULL;
 
+    /* FT_Load_Glyph(), FT_Load_Char() take FT_UInt flags */
+    if ( load_flags > FT_UINT_MAX )
+    {
+      FT_TRACE1(( "FTC_ImageCache_LookupScaler: higher bits in load_flags" ));
+      FT_TRACE1(( "0x%x are dropped\n", (load_flags & ~((FT_ULong)FT_UINT_MAX)) ));
+    }
+
     query.attrs.scaler     = scaler[0];
-    query.attrs.load_flags = load_flags;
+    query.attrs.load_flags = (FT_UInt)load_flags;
 
     /* beware, the hash must be the same for all glyph ranges! */
     hash = FTC_BASIC_ATTR_HASH( &query.attrs ) +

src/cache/ftccache.c

@@ -93,9 +93,9 @@
     for (;;)
     {
       FTC_Node  node, *pnode;
-      FT_UInt   p      = cache->p;
-      FT_UInt   mask   = cache->mask;
-      FT_UInt   count  = mask + p + 1;    /* number of buckets */
+      FT_UFast  p      = cache->p;
+      FT_UFast  mask   = cache->mask;
+      FT_UFast  count  = mask + p + 1;    /* number of buckets */
 
 
       /* do we need to shrink the buckets array? */
@@ -153,7 +153,7 @@
       /* do we need to expand the buckets array? */
       else if ( cache->slack > (FT_Long)count * FTC_HASH_SUB_LOAD )
       {
-        FT_UInt    old_index = p + mask;
+        FT_UFast   old_index = p + mask;
         FTC_Node*  pold;
 
 
@@ -347,7 +347,7 @@
     {
       FTC_Manager  manager = cache->manager;
       FT_UFast     i;
-      FT_UInt      count;
+      FT_UFast     count;
 
 
       count = cache->p + cache->mask + 1;

src/cache/ftccache.h

@@ -91,7 +91,7 @@ FT_BEGIN_HEADER
                        FT_Pointer   query,
                        FTC_Cache    cache );
 
-  typedef FT_ULong
+  typedef FT_Offset
   (*FTC_Node_WeightFunc)( FTC_Node   node,
                           FTC_Cache  cache );
 
@@ -121,7 +121,7 @@ FT_BEGIN_HEADER
     FTC_Node_CompareFunc  node_remove_faceid;
     FTC_Node_FreeFunc     node_free;
 
-    FT_UInt               cache_size;
+    FT_Offset             cache_size;
     FTC_Cache_InitFunc    cache_init;
     FTC_Cache_DoneFunc    cache_done;
 
@@ -202,7 +202,7 @@ FT_BEGIN_HEADER
     FTC_Cache             _cache   = FTC_CACHE(cache);                   \
     FT_UInt32             _hash    = (FT_UInt32)(hash);                  \
     FTC_Node_CompareFunc  _nodcomp = (FTC_Node_CompareFunc)(nodecmp);    \
-    FT_UInt               _idx;                                          \
+    FT_UFast              _idx;                                          \
                                                                          \
                                                                          \
     error = 0;                                                           \

src/cache/ftccback.h

@@ -36,7 +36,7 @@
                  FT_Pointer  gquery,
                  FTC_Cache   cache );
 
-  FT_LOCAL( FT_ULong )
+  FT_LOCAL( FT_Offset )
   ftc_inode_weight( FTC_Node   inode,
                     FTC_Cache  cache );
 
@@ -50,7 +50,7 @@
                  FT_Pointer  gquery,
                  FTC_Cache   cache );
 
-  FT_LOCAL( FT_ULong )
+  FT_LOCAL( FT_Offset )
   ftc_snode_weight( FTC_Node   snode,
                     FTC_Cache  cache );
 

src/cache/ftccmap.c

@@ -174,7 +174,7 @@
 
 
   /* compute the weight of a given cmap node */
-  FT_CALLBACK_DEF( FT_ULong )
+  FT_CALLBACK_DEF( FT_Offset )
   ftc_cmap_node_weight( FTC_Node   cnode,
                         FTC_Cache  cache )
   {

src/cache/ftcimage.c

@@ -103,12 +103,12 @@
   }
 
 
-  FT_LOCAL_DEF( FT_ULong )
+  FT_LOCAL_DEF( FT_Offset )
   ftc_inode_weight( FTC_Node   ftcinode,
                     FTC_Cache  ftccache )
   {
     FTC_INode  inode = (FTC_INode)ftcinode;
-    FT_ULong   size  = 0;
+    FT_Offset  size  = 0;
     FT_Glyph   glyph = inode->glyph;
 
     FT_UNUSED( ftccache );
@@ -151,7 +151,7 @@
 
 #if 0
 
-  FT_LOCAL_DEF( FT_ULong )
+  FT_LOCAL_DEF( FT_Offset )
   FTC_INode_Weight( FTC_INode  inode )
   {
     return ftc_inode_weight( FTC_NODE( inode ), NULL );

src/cache/ftcmanag.c

@@ -665,7 +665,9 @@
     /* this will remove all FTC_SizeNode that correspond to
      * the face_id as well
      */
-    FTC_MruList_RemoveSelection( &manager->faces, NULL, face_id );
+    FTC_MruList_RemoveSelection( &manager->faces,
+                                 (FTC_MruNode_CompareFunc)NULL,
+                                 face_id );
 
     for ( nn = 0; nn < manager->num_caches; nn++ )
       FTC_Cache_RemoveFaceID( manager->caches[nn], face_id );

src/cache/ftcmru.h

@@ -107,7 +107,7 @@ FT_BEGIN_HEADER
 
   typedef struct  FTC_MruListClassRec_
   {
-    FT_UInt                  node_size;
+    FT_Offset                node_size;
     FTC_MruNode_CompareFunc  node_compare;
     FTC_MruNode_InitFunc     node_init;
     FTC_MruNode_ResetFunc    node_reset;

src/cache/ftcsbits.c

@@ -129,7 +129,7 @@
       FT_Int        temp;
       FT_GlyphSlot  slot   = face->glyph;
       FT_Bitmap*    bitmap = &slot->bitmap;
-      FT_Int        xadvance, yadvance;
+      FT_Pos        xadvance, yadvance; /* FT_GlyphSlot->advance.{x|y} */
 
 
       if ( slot->format != FT_GLYPH_FORMAT_BITMAP )
@@ -263,7 +263,7 @@
   }
 
 
-  FT_LOCAL_DEF( FT_ULong )
+  FT_LOCAL_DEF( FT_Offset )
   ftc_snode_weight( FTC_Node   ftcsnode,
                     FTC_Cache  cache )
   {
@@ -271,7 +271,7 @@
     FT_UInt    count = snode->count;
     FTC_SBit   sbit  = snode->sbits;
     FT_Int     pitch;
-    FT_ULong   size;
+    FT_Offset  size;
 
     FT_UNUSED( cache );
 
@@ -300,7 +300,7 @@
 
 #if 0
 
-  FT_LOCAL_DEF( FT_ULong )
+  FT_LOCAL_DEF( FT_Offset )
   FTC_SNode_Weight( FTC_SNode  snode )
   {
     return ftc_snode_weight( FTC_NODE( snode ), NULL );

src/cff/cffcmap.c

@@ -65,7 +65,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   cff_cmap_encoding_char_next( CFF_CMapStd   cmap,
                                FT_UInt32    *pchar_code )
   {
@@ -192,7 +192,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   cff_cmap_unicode_char_next( PS_Unicodes  unicodes,
                               FT_UInt32   *pchar_code )
   {

src/cff/cffdrivr.c

@@ -200,7 +200,7 @@
     FT_GlyphSlot  slot  = face->glyph;
 
 
-    flags |= FT_LOAD_ADVANCE_ONLY;
+    flags |= (FT_UInt32)FT_LOAD_ADVANCE_ONLY;
 
     for ( nn = 0; nn < count; nn++ )
     {
@@ -495,8 +495,19 @@
         *ordering = cff->ordering;
       }
 
+      /*
+       * XXX: According to Adobe TechNote #5176, the supplement in CFF
+       *      can be a real number. We truncate it to fit public API
+       *      since freetype-2.3.6.
+       */
       if ( supplement )
-        *supplement = dict->cid_supplement;
+      {
+        if ( dict->cid_supplement < FT_INT_MIN ||
+             dict->cid_supplement > FT_INT_MAX )
+          FT_TRACE1(( "cff_get_ros: too large supplement %d is truncated\n",
+                      dict->cid_supplement ));
+        *supplement = (FT_Int)dict->cid_supplement;
+      }
     }
       
   Fail:

src/cff/cffgload.c

@@ -935,18 +935,18 @@
           ip += 2;
         }
         else if ( v < 247 )
-          val = (FT_Long)v - 139;
+          val = (FT_Int32)v - 139;
         else if ( v < 251 )
         {
           if ( ip >= limit )
             goto Syntax_Error;
-          val = ( (FT_Long)v - 247 ) * 256 + *ip++ + 108;
+          val = ( (FT_Int32)v - 247 ) * 256 + *ip++ + 108;
         }
         else if ( v < 255 )
         {
           if ( ip >= limit )
             goto Syntax_Error;
-          val = -( (FT_Long)v - 251 ) * 256 - *ip++ - 108;
+          val = -( (FT_Int32)v - 251 ) * 256 - *ip++ - 108;
         }
         else
         {
@@ -2580,8 +2580,8 @@
       FT_Byte  fd_index = cff_fd_select_get( &cff->fd_select,
                                              glyph_index );
 
-      FT_Int  top_upm = cff->top_font.font_dict.units_per_em;
-      FT_Int  sub_upm = cff->subfonts[fd_index]->font_dict.units_per_em;
+      FT_ULong  top_upm = cff->top_font.font_dict.units_per_em;
+      FT_ULong  sub_upm = cff->subfonts[fd_index]->font_dict.units_per_em;
 
 
       font_matrix = cff->subfonts[fd_index]->font_dict.font_matrix;

src/cff/cffload.c

@@ -847,7 +847,7 @@
 
 
             /* this constant is given in the CFF specification */
-            if ( sid < 65000 )
+            if ( sid < 65000L )
               charset->sids[j] = sid;
             else
             {
@@ -890,16 +890,16 @@
 
             /* check whether the range contains at least one valid glyph; */
             /* the constant is given in the CFF specification             */
-            if ( glyph_sid >= 65000 ) {
+            if ( glyph_sid >= 65000L ) {
               FT_ERROR(( "cff_charset_load: invalid SID range\n" ));
               error = CFF_Err_Invalid_File_Format;
               goto Exit;
             }
 
             /* try to rescue some of the SIDs if `nleft' is too large */
-            if ( nleft > 65000 - 1 || glyph_sid >= 65000 - nleft ) {
+            if ( nleft > 65000L - 1L || glyph_sid >= 65000L - nleft ) {
               FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" ));
-              nleft = 65000 - 1 - glyph_sid;
+              nleft = ( FT_UInt )( 65000L - 1L - glyph_sid );
             }
 
             /* Fill in the range of sids -- `nleft + 1' glyphs. */

src/cff/cffobjs.c

@@ -224,8 +224,8 @@
       CFF_Font      font     = (CFF_Font)face->extra.data;
       CFF_Internal  internal = (CFF_Internal)size->internal;
 
-      FT_Int   top_upm  = font->top_font.font_dict.units_per_em;
-      FT_UInt  i;
+      FT_ULong  top_upm  = font->top_font.font_dict.units_per_em;
+      FT_UInt   i;
 
 
       funcs->set_scale( internal->topfont,
@@ -235,7 +235,7 @@
       for ( i = font->num_subfonts; i > 0; i-- )
       {
         CFF_SubFont  sub     = font->subfonts[i - 1];
-        FT_Int       sub_upm = sub->font_dict.units_per_em;
+        FT_ULong     sub_upm = sub->font_dict.units_per_em;
         FT_Pos       x_scale, y_scale;
 
 
@@ -296,8 +296,8 @@
       CFF_Font      font     = (CFF_Font)cffface->extra.data;
       CFF_Internal  internal = (CFF_Internal)size->internal;
 
-      FT_Int   top_upm  = font->top_font.font_dict.units_per_em;
-      FT_UInt  i;
+      FT_ULong  top_upm  = font->top_font.font_dict.units_per_em;
+      FT_UInt   i;
 
 
       funcs->set_scale( internal->topfont,
@@ -307,7 +307,7 @@
       for ( i = font->num_subfonts; i > 0; i-- )
       {
         CFF_SubFont  sub     = font->subfonts[i - 1];
-        FT_Int       sub_upm = sub->font_dict.units_per_em;
+        FT_ULong     sub_upm = sub->font_dict.units_per_em;
         FT_Pos       x_scale, y_scale;
 
 
@@ -584,7 +584,7 @@
 
         if ( sub->units_per_em )
         {
-          FT_Int  scaling;
+          FT_Long  scaling;
 
 
           if ( top->units_per_em > 1 && sub->units_per_em > 1 )
@@ -766,22 +766,22 @@
         /*                                                                 */
         /* Compute face flags.                                             */
         /*                                                                 */
-        flags = FT_FACE_FLAG_SCALABLE   |       /* scalable outlines */
-                FT_FACE_FLAG_HORIZONTAL |       /* horizontal data   */
-                FT_FACE_FLAG_HINTER;            /* has native hinter */
+        flags = (FT_UInt32)( FT_FACE_FLAG_SCALABLE   | /* scalable outlines */
+                             FT_FACE_FLAG_HORIZONTAL | /* horizontal data   */
+                             FT_FACE_FLAG_HINTER );    /* has native hinter */
 
         if ( sfnt_format )
-          flags |= FT_FACE_FLAG_SFNT;
+          flags |= (FT_UInt32)FT_FACE_FLAG_SFNT;
 
         /* fixed width font? */
         if ( dict->is_fixed_pitch )
-          flags |= FT_FACE_FLAG_FIXED_WIDTH;
+          flags |= (FT_UInt32)FT_FACE_FLAG_FIXED_WIDTH;
 
   /* XXX: WE DO NOT SUPPORT KERNING METRICS IN THE GPOS TABLE FOR NOW */
 #if 0
         /* kerning available? */
         if ( face->kern_pairs )
-          flags |= FT_FACE_FLAG_KERNING;
+          flags |= (FT_UInt32)FT_FACE_FLAG_KERNING;
 #endif
 
         cffface->face_flags = flags;

src/cff/cffparse.c

@@ -130,8 +130,8 @@
   static FT_Fixed
   cff_parse_real( FT_Byte*  start,
                   FT_Byte*  limit,
-                  FT_Int    power_ten,
-                  FT_Int*   scaling )
+                  FT_Long   power_ten,
+                  FT_Long*  scaling )
   {
     FT_Byte*  p = start;
     FT_UInt   nib;
@@ -139,7 +139,7 @@
 
     FT_Long   result, number, rest, exponent;
     FT_Int    sign = 0, exponent_sign = 0;
-    FT_Int    exponent_add, integer_length, fraction_length;
+    FT_Long   exponent_add, integer_length, fraction_length;
 
 
     if ( scaling )
@@ -155,6 +155,8 @@
     integer_length  = 0;
     fraction_length = 0;
 
+    FT_UNUSED( rest );
+
     /* First of all, read the integer part. */
     phase = 4;
 
@@ -284,7 +286,7 @@
         {
           if ( exponent > 0 )
           {
-            FT_Int  new_fraction_length, shift;
+            FT_Long  new_fraction_length, shift;
 
 
             /* Make `scaling' as small as possible. */
@@ -384,7 +386,7 @@
   /* but return `10^scaling' times the number read in      */
   static FT_Fixed
   cff_parse_fixed_scaled( FT_Byte**  d,
-                          FT_Int     scaling )
+                          FT_Long    scaling )
   {
     return **d == 30 ? cff_parse_real( d[0], d[1], scaling, NULL )
                      : ( cff_parse_integer( d[0], d[1] ) *
@@ -397,7 +399,7 @@
   /* the scaling factor (as a power of 10)                     */
   static FT_Fixed
   cff_parse_fixed_dynamic( FT_Byte**  d,
-                           FT_Int*    scaling )
+                           FT_Long*   scaling )
   {
     FT_ASSERT( scaling );
 
@@ -450,7 +452,7 @@
 
     if ( parser->top >= parser->stack + 6 )
     {
-      FT_Int  scaling;
+      FT_Long  scaling;
 
 
       error = CFF_Err_Ok;
@@ -552,7 +554,12 @@
     {
       dict->cid_registry   = (FT_UInt)cff_parse_num ( data++ );
       dict->cid_ordering   = (FT_UInt)cff_parse_num ( data++ );
-      dict->cid_supplement = (FT_ULong)cff_parse_num( data );
+      if ( **data == 30 )
+        FT_TRACE1(( "cff_parse_cid_ros: real supplement is rounded\n" ));
+      dict->cid_supplement = cff_parse_num( data );
+      if ( dict->cid_supplement < 0 )
+        FT_TRACE1(( "cff_parse_cid_ros: negative supplement %d is found\n",
+                   dict->cid_supplement ));
       error = CFF_Err_Ok;
     }
 

src/cff/cfftypes.h

@@ -130,7 +130,7 @@ FT_BEGIN_HEADER
     /* these should only be used for the top-level font dictionary */
     FT_UInt    cid_registry;
     FT_UInt    cid_ordering;
-    FT_ULong   cid_supplement;
+    FT_Long    cid_supplement;
 
     FT_Long    cid_font_version;
     FT_Long    cid_font_revision;

src/cid/cidparse.c

@@ -86,13 +86,13 @@
     /* `StartData' or `/sfnts'                      */
     {
       FT_Byte   buffer[256 + 10];
-      FT_Int    read_len = 256 + 10;
+      FT_Long   read_len = 256 + 10; /* same as signed FT_Stream->size */
       FT_Byte*  p        = buffer;
 
 
-      for ( offset = (FT_ULong)FT_STREAM_POS(); ; offset += 256 )
+      for ( offset = FT_STREAM_POS(); ; offset += 256 )
       {
-        FT_Int  stream_len;
+        FT_Long  stream_len; /* same as signed FT_Stream->size */
 
 
         stream_len = stream->size - FT_STREAM_POS();

src/gxvalid/gxvbsln.c

@@ -71,10 +71,10 @@
 
   static void
   gxv_bsln_LookupValue_validate( FT_UShort            glyph,
-                                 GXV_LookupValueDesc  value,
+                                 GXV_LookupValueCPtr  value_p,
                                  GXV_Validator        valid )
   {
-    FT_UShort   v = value.u;
+    FT_UShort   v = value_p->u;
     FT_UShort*  ctlPoints;
 
     FT_UNUSED( glyph );
@@ -122,7 +122,7 @@
 
   static GXV_LookupValueDesc
   gxv_bsln_LookupFmt4_transit( FT_UShort            relative_gindex,
-                               GXV_LookupValueDesc  base_value,
+                               GXV_LookupValueCPtr  base_value_p,
                                FT_Bytes             lookuptbl_limit,
                                GXV_Validator        valid )
   {
@@ -132,7 +132,7 @@
     GXV_LookupValueDesc  value;
 
     /* XXX: check range ? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           ( relative_gindex * sizeof ( FT_UShort ) ) );
 
     p     = valid->lookuptbl_head + offset;

src/gxvalid/gxvcommn.c

@@ -448,7 +448,7 @@
       }
 
       value = GXV_LOOKUP_VALUE_LOAD( p, valid->lookupval_sign );
-      valid->lookupval_func( i, value, valid );
+      valid->lookupval_func( i, &value, valid );
     }
 
     valid->subtable_length = p - table;
@@ -553,7 +553,7 @@
       }
 
       for ( gid = firstGlyph; gid <= lastGlyph; gid++ )
-        valid->lookupval_func( gid, value, valid );
+        valid->lookupval_func( gid, &value, valid );
     }
 
     gxv_LookupTable_fmt2_skip_endmarkers( p, unitSize, valid );
@@ -631,11 +631,11 @@
       for ( gid = firstGlyph; gid <= lastGlyph; gid++ )
       {
         value = valid->lookupfmt4_trans( (FT_UShort)( gid - firstGlyph ),
-                                         base_value,
+                                         &base_value,
                                          limit,
                                          valid );
 
-        valid->lookupval_func( gid, value, valid );
+        valid->lookupval_func( gid, &value, valid );
       }
     }
 
@@ -710,7 +710,7 @@
       }
       prev_glyph = glyph;
 
-      valid->lookupval_func( glyph, value, valid );
+      valid->lookupval_func( glyph, &value, valid );
     }
 
     gxv_LookupTable_fmt6_skip_endmarkers( p, unitSize, valid );
@@ -750,7 +750,7 @@
     {
       GXV_LIMIT_CHECK( 2 );
       value = GXV_LOOKUP_VALUE_LOAD( p, valid->lookupval_sign );
-      valid->lookupval_func( (FT_UShort)( firstGlyph + i ), value, valid );
+      valid->lookupval_func( (FT_UShort)( firstGlyph + i ), &value, valid );
     }
 
     valid->subtable_length = p - table;
@@ -1181,7 +1181,7 @@
       if ( NULL != valid->statetable.entry_validate_func )
         valid->statetable.entry_validate_func( state,
                                                flags,
-                                               glyphOffset,
+                                               &glyphOffset,
                                                statetable_table,
                                                statetable_limit,
                                                valid );
@@ -1352,15 +1352,15 @@
 
   static void
   gxv_XClassTable_lookupval_validate( FT_UShort            glyph,
-                                      GXV_LookupValueDesc  value,
+                                      GXV_LookupValueCPtr  value_p,
                                       GXV_Validator        valid )
   {
     FT_UNUSED( glyph );
 
-    if ( value.u >= valid->xstatetable.nClasses )
+    if ( value_p->u >= valid->xstatetable.nClasses )
       FT_INVALID_DATA;
-    if ( value.u > valid->xstatetable.maxClassID )
-      valid->xstatetable.maxClassID = value.u;
+    if ( value_p->u > valid->xstatetable.maxClassID )
+      valid->xstatetable.maxClassID = value_p->u;
   }
 
 
@@ -1392,7 +1392,7 @@
   */
   static GXV_LookupValueDesc
   gxv_XClassTable_lookupfmt4_transit( FT_UShort            relative_gindex,
-                                      GXV_LookupValueDesc  base_value,
+                                      GXV_LookupValueCPtr  base_value_p,
                                       FT_Bytes             lookuptbl_limit,
                                       GXV_Validator        valid )
   {
@@ -1402,7 +1402,7 @@
     GXV_LookupValueDesc  value;
 
     /* XXX: check range? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           relative_gindex * sizeof ( FT_UShort ) );
 
     p     = valid->lookuptbl_head + offset;
@@ -1556,7 +1556,7 @@
       if ( NULL != valid->xstatetable.entry_validate_func )
         valid->xstatetable.entry_validate_func( state,
                                                 flags,
-                                                glyphOffset,
+                                                &glyphOffset,
                                                 xstatetable_table,
                                                 xstatetable_limit,
                                                 valid );

src/gxvalid/gxvcommn.h

@@ -79,6 +79,8 @@ FT_BEGIN_HEADER
 
   } GXV_LookupValueDesc;
 
+  typedef const GXV_LookupValueDesc* GXV_LookupValueCPtr;
+
   typedef enum  GXV_LookupValue_SignSpec_
   {
     GXV_LOOKUPVALUE_UNSIGNED = 0,
@@ -89,12 +91,12 @@ FT_BEGIN_HEADER
 
   typedef void
   (*GXV_Lookup_Value_Validate_Func)( FT_UShort            glyph,
-                                     GXV_LookupValueDesc  value,
+                                     GXV_LookupValueCPtr  value_p,
                                      GXV_Validator        valid );
 
   typedef GXV_LookupValueDesc
   (*GXV_Lookup_Fmt4_Transit_Func)( FT_UShort            relative_gindex,
-                                   GXV_LookupValueDesc  base_value,
+                                   GXV_LookupValueCPtr  base_value_p,
                                    FT_Bytes             lookuptbl_limit,
                                    GXV_Validator        valid );
 
@@ -134,6 +136,7 @@ FT_BEGIN_HEADER
 
   } GXV_StateTable_GlyphOffsetDesc;
 
+  typedef const GXV_StateTable_GlyphOffsetDesc* GXV_StateTable_GlyphOffsetCPtr;
 
   typedef void
   (*GXV_StateTable_Subtable_Setup_Func)( FT_UShort      table_size,
@@ -149,7 +152,7 @@ FT_BEGIN_HEADER
   (*GXV_StateTable_Entry_Validate_Func)(
      FT_Byte                         state,
      FT_UShort                       flags,
-     GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+     GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
      FT_Bytes                        statetable_table,
      FT_Bytes                        statetable_limit,
      GXV_Validator                   valid );
@@ -175,6 +178,8 @@ FT_BEGIN_HEADER
 
   typedef GXV_StateTable_GlyphOffsetDesc  GXV_XStateTable_GlyphOffsetDesc;
 
+  typedef const GXV_XStateTable_GlyphOffsetDesc* GXV_XStateTable_GlyphOffsetCPtr;
+
   typedef void
   (*GXV_XStateTable_Subtable_Setup_Func)( FT_ULong       table_size,
                                           FT_ULong       classTable,
@@ -189,7 +194,7 @@ FT_BEGIN_HEADER
   (*GXV_XStateTable_Entry_Validate_Func)(
      FT_UShort                       state,
      FT_UShort                       flags,
-     GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+     GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
      FT_Bytes                        xstatetable_table,
      FT_Bytes                        xstatetable_limit,
      GXV_Validator                   valid );

src/gxvalid/gxvfeat.c

@@ -199,7 +199,7 @@
 
     FT_UShort  feature;
     FT_UShort  nSettings;
-    FT_UInt    settingTable;
+    FT_ULong   settingTable;
     FT_UShort  featureFlags;
 
     FT_Bool    exclusive;

src/gxvalid/gxvjust.c

@@ -323,15 +323,15 @@
 
   static void
   gxv_just_pcTable_LookupValue_entry_validate( FT_UShort            glyph,
-                                               GXV_LookupValueDesc  value,
+                                               GXV_LookupValueCPtr  value_p,
                                                GXV_Validator        valid )
   {
     FT_UNUSED( glyph );
 
-    if ( value.u > GXV_JUST_DATA( pc_offset_max ) )
-      GXV_JUST_DATA( pc_offset_max ) = value.u;
-    if ( value.u < GXV_JUST_DATA( pc_offset_max ) )
-      GXV_JUST_DATA( pc_offset_min ) = value.u;
+    if ( value_p->u > GXV_JUST_DATA( pc_offset_max ) )
+      GXV_JUST_DATA( pc_offset_max ) = value_p->u;
+    if ( value_p->u < GXV_JUST_DATA( pc_offset_max ) )
+      GXV_JUST_DATA( pc_offset_min ) = value_p->u;
   }
 
 
@@ -384,7 +384,7 @@
   gxv_just_classTable_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -395,7 +395,7 @@
     FT_UShort  currentClass;
 
     FT_UNUSED( state );
-    FT_UNUSED( glyphOffset );
+    FT_UNUSED( glyphOffset_p );
     FT_UNUSED( table );
     FT_UNUSED( limit );
     FT_UNUSED( valid );
@@ -449,15 +449,15 @@
 
   static void
   gxv_just_wdcTable_LookupValue_validate( FT_UShort            glyph,
-                                          GXV_LookupValueDesc  value,
+                                          GXV_LookupValueCPtr  value_p,
                                           GXV_Validator        valid )
   {
     FT_UNUSED( glyph );
 
-    if ( value.u > GXV_JUST_DATA( wdc_offset_max ) )
-      GXV_JUST_DATA( wdc_offset_max ) = value.u;
-    if ( value.u < GXV_JUST_DATA( wdc_offset_min ) )
-      GXV_JUST_DATA( wdc_offset_min ) = value.u;
+    if ( value_p->u > GXV_JUST_DATA( wdc_offset_max ) )
+      GXV_JUST_DATA( wdc_offset_max ) = value_p->u;
+    if ( value_p->u < GXV_JUST_DATA( wdc_offset_min ) )
+      GXV_JUST_DATA( wdc_offset_min ) = value_p->u;
   }
 
 
@@ -557,7 +557,7 @@
   {
     FT_Bytes           p     = table;
     FT_Bytes           limit = 0;
-    FT_UInt            table_size;
+    FT_Offset          table_size;
 
     GXV_ValidatorRec   validrec;
     GXV_Validator      valid = &validrec;

src/gxvalid/gxvkern.c

@@ -256,7 +256,7 @@
   gxv_kern_subtable_fmt1_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -268,7 +268,7 @@
     FT_UShort  kernValue;
 
     FT_UNUSED( state );
-    FT_UNUSED( glyphOffset );
+    FT_UNUSED( glyphOffset_p );
 
 
     push        = (FT_UShort)( ( flags >> 15 ) & 1      );

src/gxvalid/gxvlcar.c

@@ -83,10 +83,10 @@
 
   static void
   gxv_lcar_LookupValue_validate( FT_UShort            glyph,
-                                 GXV_LookupValueDesc  value,
+                                 GXV_LookupValueCPtr  value_p,
                                  GXV_Validator        valid )
   {
-    FT_Bytes   p     = valid->root->base + value.u;
+    FT_Bytes   p     = valid->root->base + value_p->u;
     FT_Bytes   limit = valid->root->limit;
     FT_UShort  count;
     FT_Short   partial;
@@ -146,7 +146,7 @@
 
   static GXV_LookupValueDesc
   gxv_lcar_LookupFmt4_transit( FT_UShort            relative_gindex,
-                               GXV_LookupValueDesc  base_value,
+                               GXV_LookupValueCPtr  base_value_p,
                                FT_Bytes             lookuptbl_limit,
                                GXV_Validator        valid )
   {
@@ -158,7 +158,7 @@
     FT_UNUSED( lookuptbl_limit );
 
     /* XXX: check range? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           relative_gindex * sizeof ( FT_UShort ) );
     p      = valid->root->base + offset;
     limit  = valid->root->limit;

src/gxvalid/gxvmort.c

@@ -85,17 +85,17 @@
 
 
   /*
-   * nFeatureFlags is typed to FT_UInt to accept that in
+   * nFeatureFlags is typed to FT_ULong to accept that in
    * mort (typed FT_UShort) and morx (typed FT_ULong).
    */
   FT_LOCAL_DEF( void )
   gxv_mort_featurearray_validate( FT_Bytes       table,
                                   FT_Bytes       limit,
-                                  FT_UInt        nFeatureFlags,
+                                  FT_ULong       nFeatureFlags,
                                   GXV_Validator  valid )
   {
     FT_Bytes  p = table;
-    FT_UInt   i;
+    FT_ULong  i;
 
     GXV_mort_featureRec  f = GXV_MORT_FEATURE_OFF;
 

src/gxvalid/gxvmort.h

@@ -54,7 +54,7 @@
   FT_LOCAL( void )
   gxv_mort_featurearray_validate( FT_Bytes       table,
                                   FT_Bytes       limit,
-                                  FT_UInt        nFeatureFlags,
+                                  FT_ULong       nFeatureFlags,
                                   GXV_Validator  valid );
 
   FT_LOCAL( void )

src/gxvalid/gxvmort0.c

@@ -64,7 +64,7 @@
   gxv_mort_subtable_type0_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -80,7 +80,7 @@
     FT_UNUSED( limit );
 
     FT_UNUSED( GXV_Mort_IndicScript_Msg[verb] ); /* for the non-debugging */
-    FT_UNUSED( glyphOffset );                    /* case                  */
+    FT_UNUSED( glyphOffset_p );                  /* case                  */
 
 
     markFirst   = (FT_UShort)( ( flags >> 15 ) & 1 );
@@ -91,7 +91,7 @@
     verb     = (FT_UShort)( flags & 0x000F );
 
     GXV_TRACE(( "  IndicScript MorphRule for glyphOffset 0x%04x",
-                glyphOffset.u ));
+                glyphOffset_p->u ));
     GXV_TRACE(( " markFirst=%01d", markFirst ));
     GXV_TRACE(( " dontAdvance=%01d", dontAdvance ));
     GXV_TRACE(( " markLast=%01d", markLast ));

src/gxvalid/gxvmort1.c

@@ -135,7 +135,7 @@
   gxv_mort_subtable_type1_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -154,8 +154,8 @@
     dontAdvance   = (FT_UShort)( ( flags >> 14 ) & 1      );
     reserved      = (FT_Short)(    flags         & 0x3FFF );
 
-    markOffset    = (FT_Short)( glyphOffset.ul >> 16 );
-    currentOffset = (FT_Short)( glyphOffset.ul       );
+    markOffset    = (FT_Short)( glyphOffset_p->ul >> 16 );
+    currentOffset = (FT_Short)( glyphOffset_p->ul       );
 
     if ( 0 < reserved )
     {

src/gxvalid/gxvmort2.c

@@ -189,7 +189,7 @@
   gxv_mort_subtable_type2_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -199,7 +199,7 @@
     FT_UShort offset;
 
     FT_UNUSED( state );
-    FT_UNUSED( glyphOffset );
+    FT_UNUSED( glyphOffset_p );
     FT_UNUSED( limit );
 
 

src/gxvalid/gxvmort4.c

@@ -40,12 +40,12 @@
 
   static void
   gxv_mort_subtable_type4_lookupval_validate( FT_UShort            glyph,
-                                              GXV_LookupValueDesc  value,
+                                              GXV_LookupValueCPtr  value_p,
                                               GXV_Validator        valid )
   {
     FT_UNUSED( glyph );
 
-    gxv_glyphid_validate( value.u, valid );
+    gxv_glyphid_validate( value_p->u, valid );
   }
 
   /*
@@ -78,7 +78,7 @@
   static GXV_LookupValueDesc
   gxv_mort_subtable_type4_lookupfmt4_transit(
     FT_UShort            relative_gindex,
-    GXV_LookupValueDesc  base_value,
+    GXV_LookupValueCPtr  base_value_p,
     FT_Bytes             lookuptbl_limit,
     GXV_Validator        valid )
   {
@@ -88,7 +88,7 @@
     GXV_LookupValueDesc  value;
 
     /* XXX: check range? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           relative_gindex * sizeof ( FT_UShort ) );
 
     p     = valid->lookuptbl_head + offset;

src/gxvalid/gxvmort5.c

@@ -139,7 +139,7 @@
   gxv_mort_subtable_type5_entry_validate(
     FT_Byte                         state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -168,8 +168,8 @@
     currentInsertCount   = (FT_Byte)( ( flags >> 5 ) & 0x1F   );
     markedInsertCount    = (FT_Byte)(   flags        & 0x001F );
 
-    currentInsertList    = (FT_UShort)( glyphOffset.ul >> 16 );
-    markedInsertList     = (FT_UShort)( glyphOffset.ul       );
+    currentInsertList    = (FT_UShort)( glyphOffset->ul >> 16 );
+    markedInsertList     = (FT_UShort)( glyphOffset->ul       );
 
     if ( 0 != currentInsertList && 0 != currentInsertCount )
     {

src/gxvalid/gxvmorx.c

@@ -69,8 +69,8 @@
       FT_ULong  length;
       FT_ULong  coverage;
       FT_ULong  subFeatureFlags;
-      FT_UInt   type;
-      FT_UInt   rest;
+      FT_ULong  type;
+      FT_ULong  rest;
 
 
       GXV_LIMIT_CHECK( 4 + 4 + 4 );

src/gxvalid/gxvmorx0.c

@@ -42,7 +42,7 @@
   gxv_morx_subtable_type0_entry_validate(
     FT_UShort                        state,
     FT_UShort                        flags,
-    GXV_XStateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_XStateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                         table,
     FT_Bytes                         limit,
     GXV_Validator                    valid )
@@ -54,7 +54,7 @@
     FT_UShort  verb;
 
     FT_UNUSED( state );
-    FT_UNUSED( glyphOffset );
+    FT_UNUSED( glyphOffset_p );
     FT_UNUSED( table );
     FT_UNUSED( limit );
 

src/gxvalid/gxvmorx1.c

@@ -103,7 +103,7 @@
   gxv_morx_subtable_type1_entry_validate(
     FT_UShort                       state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -127,8 +127,8 @@
 
     reserved = (FT_UShort)( flags & 0x3FFF );
 
-    markIndex    = (FT_Short)( glyphOffset.ul >> 16 );
-    currentIndex = (FT_Short)( glyphOffset.ul       );
+    markIndex    = (FT_Short)( glyphOffset_p->ul >> 16 );
+    currentIndex = (FT_Short)( glyphOffset_p->ul       );
 
     GXV_TRACE(( " setMark=%01d dontAdvance=%01d\n",
                 setMark, dontAdvance ));
@@ -155,14 +155,14 @@
 
   static void
   gxv_morx_subtable_type1_LookupValue_validate( FT_UShort            glyph,
-                                                GXV_LookupValueDesc  value,
+                                                GXV_LookupValueCPtr  value_p,
                                                 GXV_Validator        valid )
   {
     FT_UNUSED( glyph ); /* for the non-debugging case */
 
-    GXV_TRACE(( "morx subtable type1 subst.: %d -> %d\n", glyph, value.u ));
+    GXV_TRACE(( "morx subtable type1 subst.: %d -> %d\n", glyph, value_p->u ));
 
-    if ( value.u > valid->face->num_glyphs )
+    if ( value_p->u > valid->face->num_glyphs )
       FT_INVALID_GLYPH_ID;
   }
 
@@ -170,7 +170,7 @@
   static GXV_LookupValueDesc
   gxv_morx_subtable_type1_LookupFmt4_transit(
     FT_UShort            relative_gindex,
-    GXV_LookupValueDesc  base_value,
+    GXV_LookupValueCPtr  base_value_p,
     FT_Bytes             lookuptbl_limit,
     GXV_Validator        valid )
   {
@@ -180,7 +180,7 @@
     GXV_LookupValueDesc  value;
 
     /* XXX: check range? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           relative_gindex * sizeof ( FT_UShort ) );
 
     p     = valid->lookuptbl_head + offset;

src/gxvalid/gxvmorx2.c

@@ -186,7 +186,7 @@
   gxv_morx_subtable_type2_entry_validate(
     FT_UShort                       state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -206,7 +206,7 @@
     performAction  = (FT_UShort)( ( flags >> 13 ) & 1 );
 
     reserved       = (FT_UShort)( flags & 0x1FFF );
-    ligActionIndex = glyphOffset.u;
+    ligActionIndex = glyphOffset_p->u;
 
     if ( reserved > 0 )
       GXV_TRACE(( "  reserved 14bit is non-zero\n" ));

src/gxvalid/gxvmorx5.c

@@ -136,7 +136,7 @@
   gxv_morx_subtable_type5_entry_validate(
     FT_UShort                       state,
     FT_UShort                       flags,
-    GXV_StateTable_GlyphOffsetDesc  glyphOffset,
+    GXV_StateTable_GlyphOffsetCPtr  glyphOffset_p,
     FT_Bytes                        table,
     FT_Bytes                        limit,
     GXV_Validator                   valid )
@@ -165,8 +165,8 @@
     currentInsertCount = (FT_Byte)( ( flags >> 5 ) & 0x1F   );
     markedInsertCount  = (FT_Byte)(   flags        & 0x001F );
 
-    currentInsertList = (FT_Byte)  ( glyphOffset.ul >> 16 );
-    markedInsertList  = (FT_UShort)( glyphOffset.ul       );
+    currentInsertList = (FT_Byte)  ( glyphOffset_p->ul >> 16 );
+    markedInsertList  = (FT_UShort)( glyphOffset_p->ul       );
 
     if ( currentInsertList && 0 != currentInsertCount )
       gxv_morx_subtable_type5_InsertList_validate( currentInsertList,

src/gxvalid/gxvopbd.c

@@ -67,18 +67,18 @@
 
   static void
   gxv_opbd_LookupValue_validate( FT_UShort            glyph,
-                                 GXV_LookupValueDesc  value,
+                                 GXV_LookupValueCPtr  value_p,
                                  GXV_Validator        valid )
   {
     /* offset in LookupTable is measured from the head of opbd table */
-    FT_Bytes   p     = valid->root->base + value.u;
+    FT_Bytes   p     = valid->root->base + value_p->u;
     FT_Bytes   limit = valid->root->limit;
     FT_Short   delta_value;
     int        i;
 
 
-    if ( value.u < GXV_OPBD_DATA( valueOffset_min ) )
-      GXV_OPBD_DATA( valueOffset_min ) = value.u;
+    if ( value_p->u < GXV_OPBD_DATA( valueOffset_min ) )
+      GXV_OPBD_DATA( valueOffset_min ) = value_p->u;
 
     for ( i = 0; i < 4; i++ )
     {
@@ -132,7 +132,7 @@
 
   static GXV_LookupValueDesc
   gxv_opbd_LookupFmt4_transit( FT_UShort            relative_gindex,
-                               GXV_LookupValueDesc  base_value,
+                               GXV_LookupValueCPtr  base_value_p,
                                FT_Bytes             lookuptbl_limit,
                                GXV_Validator        valid )
   {
@@ -142,7 +142,7 @@
     FT_UNUSED( valid );
 
     /* XXX: check range? */
-    value.u = (FT_UShort)( base_value.u +
+    value.u = (FT_UShort)( base_value_p->u +
                            relative_gindex * 4 * sizeof ( FT_Short ) );
 
     return value;

src/gxvalid/gxvprop.c

@@ -168,10 +168,10 @@
 
   static void
   gxv_prop_LookupValue_validate( FT_UShort            glyph,
-                                 GXV_LookupValueDesc  value,
+                                 GXV_LookupValueCPtr  value_p,
                                  GXV_Validator        valid )
   {
-    gxv_prop_property_validate( value.u, glyph, valid );
+    gxv_prop_property_validate( value_p->u, glyph, valid );
   }
 
 
@@ -204,7 +204,7 @@
 
   static GXV_LookupValueDesc
   gxv_prop_LookupFmt4_transit( FT_UShort            relative_gindex,
-                               GXV_LookupValueDesc  base_value,
+                               GXV_LookupValueCPtr  base_value_p,
                                FT_Bytes             lookuptbl_limit,
                                GXV_Validator        valid )
   {
@@ -214,7 +214,7 @@
     GXV_LookupValueDesc  value;
 
     /* XXX: check range? */
-    offset = (FT_UShort)( base_value.u +
+    offset = (FT_UShort)( base_value_p->u +
                           relative_gindex * sizeof( FT_UShort ) );
     p      = valid->lookuptbl_head + offset;
     limit  = lookuptbl_limit;

src/gxvalid/gxvtrak.c

@@ -198,7 +198,7 @@
   {
     FT_Bytes          p = table;
     FT_Bytes          limit = 0;
-    FT_UInt           table_size;
+    FT_Offset         table_size;
 
     GXV_ValidatorRec  validrec;
     GXV_Validator     valid = &validrec;

src/gzip/ftgzip.c

@@ -58,7 +58,9 @@
  /* original ZLib.                                                   */
 
 #define NO_DUMMY_DECL
-#define MY_ZCALLOC
+#ifndef USE_ZLIB_ZCALLOC
+#define MY_ZCALLOC /* prevent all zcalloc() & zfree() in zutils.c */
+#endif
 
 #include "zlib.h"
 
@@ -121,7 +123,7 @@
   }
 
 
-#ifndef FT_CONFIG_OPTION_SYSTEM_ZLIB
+#if !defined( FT_CONFIG_OPTION_SYSTEM_ZLIB ) && !defined( USE_ZLIB_ZCALLOC )
 
   local voidpf
   zcalloc ( voidpf    opaque,
@@ -138,7 +140,7 @@
     ft_gzip_free( (FT_Memory)opaque, ptr );
   }
 
-#endif /* !SYSTEM_ZLIB */
+#endif /* !SYSTEM_ZLIB && !USE_ZLIB_ZCALLOC */
 
 
 /***************************************************************************/

src/gzip/zutil.c

@@ -49,7 +49,7 @@ void zmemzero(dest, len)
 }
 #endif
 
-#ifdef __TURBOC__
+#if defined( MSDOS ) && defined( __TURBOC__ ) && !defined( MY_ZCALLOC )
 #if (defined( __BORLANDC__) || !defined(SMALL_MEDIUM)) && !defined(__32BIT__)
 /* Small and medium model in Turbo C are for now limited to near allocation
  * with reduced MAX_WBITS and MAX_MEM_LEVEL
@@ -126,10 +126,10 @@ void  zcfree (voidpf opaque, voidpf ptr)
     Assert(0, "zcfree: ptr not found");
 }
 #endif
-#endif /* __TURBOC__ */
+#endif /* MSDOS && __TURBOC__ */
 
 
-#if defined(M_I86) && !defined(__32BIT__)
+#if defined(M_I86) && !defined(__32BIT__) && !defined( MY_ZCALLOC )
 /* Microsoft C in 16-bit mode */
 
 #  define MY_ZCALLOC

src/lzw/ftzopen.c

@@ -113,8 +113,8 @@
     {
       FT_Memory  memory = state->memory;
       FT_Error   error;
-      FT_UInt    old_size = state->stack_size;
-      FT_UInt    new_size = old_size;
+      FT_Offset  old_size = state->stack_size;
+      FT_Offset  new_size = old_size;
 
       new_size = new_size + ( new_size >> 1 ) + 4;
 

src/lzw/ftzopen.h

@@ -118,7 +118,7 @@
     FT_Int       buf_offset;
     FT_Int       buf_size;
     FT_Bool      buf_clear;
-    FT_Int       buf_total;
+    FT_Offset    buf_total;
 
     FT_UInt      max_bits;    /* max code bits, from file header   */
     FT_Int       block_mode;  /* block mode flag, from file header */
@@ -137,7 +137,7 @@
 
     FT_Byte*     stack;       /* character stack */
     FT_UInt      stack_top;
-    FT_UInt      stack_size;
+    FT_Offset    stack_size;
     FT_Byte      stack_0[FT_LZW_DEFAULT_STACK_SIZE]; /* minimize heap alloc */
 
     FT_Stream    source;      /* source stream */

src/otvalid/otvgpos.c

@@ -209,7 +209,7 @@
     {
       if ( format & 1 )
       {
-        FT_UInt   table_size;
+        FT_PtrDist  table_size;
 
         OTV_OPTIONAL_TABLE( device );
 
@@ -911,7 +911,8 @@
     {
     case 1:     /* ExtensionPosFormat1 */
       {
-        FT_UInt            ExtensionLookupType, ExtensionOffset;
+        FT_UInt            ExtensionLookupType;
+        FT_ULong           ExtensionOffset;
         OTV_Validate_Func  validate;
 
 

src/otvalid/otvgsub.c

@@ -415,7 +415,8 @@
     {
     case 1:     /* ExtensionSubstFormat1 */
       {
-        FT_UInt            ExtensionLookupType, ExtensionOffset;
+        FT_UInt            ExtensionLookupType;
+        FT_ULong           ExtensionOffset;
         OTV_Validate_Func  validate;
 
 

src/otvalid/otvmod.c

@@ -82,12 +82,25 @@
     FT_Byte* volatile         math;
     FT_ULong                  len_base, len_gdef, len_gpos, len_gsub, len_jstf;
     FT_ULong                  len_math;
+    FT_UInt                   num_glyphs = (FT_UInt)face->num_glyphs;
     FT_ValidatorRec volatile  valid;
 
 
     base     = gdef     = gpos     = gsub     = jstf     = math     = NULL;
     len_base = len_gdef = len_gpos = len_gsub = len_jstf = len_math = 0;
 
+    /*
+     * XXX: OpenType tables cannot handle 32-bit glyph index,
+     *      although broken TrueType can have 32-bit glyph index.
+     */
+    if ( face->num_glyphs > 0xFFFFL )
+    {
+      FT_TRACE1(( "otv_validate: Invalid glyphs index (0x0000FFFF - 0x%08x) ",
+                  face->num_glyphs ));
+      FT_TRACE1(( "are not handled by OpenType tables\n" ));
+      num_glyphs = 0xFFFF;
+    }
+
     /* load tables */
 
     if ( ot_flags & FT_VALIDATE_BASE )
@@ -148,7 +161,7 @@
     {
       ft_validator_init( &valid, gpos, gpos + len_gpos, FT_VALIDATE_DEFAULT );
       if ( ft_setjmp( valid.jump_buffer ) == 0 )
-        otv_GPOS_validate( gpos, face->num_glyphs, &valid );
+        otv_GPOS_validate( gpos, num_glyphs, &valid );
       error = valid.error;
       if ( error )
         goto Exit;
@@ -158,7 +171,7 @@
     {
       ft_validator_init( &valid, gsub, gsub + len_gsub, FT_VALIDATE_DEFAULT );
       if ( ft_setjmp( valid.jump_buffer ) == 0 )
-        otv_GSUB_validate( gsub, face->num_glyphs, &valid );
+        otv_GSUB_validate( gsub, num_glyphs, &valid );
       error = valid.error;
       if ( error )
         goto Exit;
@@ -168,7 +181,7 @@
     {
       ft_validator_init( &valid, gdef, gdef + len_gdef, FT_VALIDATE_DEFAULT );
       if ( ft_setjmp( valid.jump_buffer ) == 0 )
-        otv_GDEF_validate( gdef, gsub, gpos, face->num_glyphs, &valid );
+        otv_GDEF_validate( gdef, gsub, gpos, num_glyphs, &valid );
       error = valid.error;
       if ( error )
         goto Exit;
@@ -178,7 +191,7 @@
     {
       ft_validator_init( &valid, jstf, jstf + len_jstf, FT_VALIDATE_DEFAULT );
       if ( ft_setjmp( valid.jump_buffer ) == 0 )
-        otv_JSTF_validate( jstf, gsub, gpos, face->num_glyphs, &valid );
+        otv_JSTF_validate( jstf, gsub, gpos, num_glyphs, &valid );
       error = valid.error;
       if ( error )
         goto Exit;
@@ -188,7 +201,7 @@
     {
       ft_validator_init( &valid, math, math + len_math, FT_VALIDATE_DEFAULT );
       if ( ft_setjmp( valid.jump_buffer ) == 0 )
-        otv_MATH_validate( math, face->num_glyphs, &valid );
+        otv_MATH_validate( math, num_glyphs, &valid );
       error = valid.error;
       if ( error )
         goto Exit;

src/pcf/pcf.h

@@ -72,8 +72,8 @@ FT_BEGIN_HEADER
     union
     {
       FT_String*  atom;
-      FT_Long     integer;
-      FT_ULong    cardinal;
+      FT_Long     l;
+      FT_ULong    ul;
 
     } value;
 

src/pcf/pcfdrivr.c

@@ -111,7 +111,7 @@ THE SOFTWARE.
 
     while ( min < max )
     {
-      FT_UInt32  code;
+      FT_ULong  code;
 
 
       mid  = ( min + max ) >> 1;
@@ -140,7 +140,7 @@ THE SOFTWARE.
     PCF_CMap      cmap      = (PCF_CMap)pcfcmap;
     PCF_Encoding  encodings = cmap->encodings;
     FT_UInt       min, max, mid;
-    FT_UInt32     charcode  = *acharcode + 1;
+    FT_ULong      charcode  = *acharcode + 1;
     FT_UInt       result    = 0;
 
 
@@ -149,7 +149,7 @@ THE SOFTWARE.
 
     while ( min < max )
     {
-      FT_UInt32  code;
+      FT_ULong  code;
 
 
       mid  = ( min + max ) >> 1;
@@ -175,7 +175,14 @@ THE SOFTWARE.
     }
 
   Exit:
-    *acharcode = charcode;
+    if ( charcode > 0xFFFFFFFFUL )
+    {
+      FT_TRACE1(( "pcf_cmap_char_next: charcode 0x%x > 32bit API" ));
+      *acharcode = 0;
+      /* XXX: result should be changed to indicate an overflow error */
+    }
+    else
+      *acharcode = (FT_UInt32)charcode;
     return result;
   }
 
@@ -448,7 +455,7 @@ THE SOFTWARE.
     FT_Error    error  = PCF_Err_Ok;
     FT_Bitmap*  bitmap = &slot->bitmap;
     PCF_Metric  metric;
-    int         bytes;
+    FT_Offset   bytes;
 
     FT_UNUSED( load_flags );
 
@@ -578,12 +585,17 @@ THE SOFTWARE.
       }
       else
       {
+        if ( prop->value.l > 0x7FFFFFFFL || prop->value.l < ( -1 - 0x7FFFFFFFL ) )
+        {
+          FT_TRACE1(( "pcf_get_bdf_property: " ));
+          FT_TRACE1(( "too large integer 0x%x is truncated\n" ));
+        }
         /* Apparently, the PCF driver loads all properties as signed integers!
          * This really doesn't seem to be a problem, because this is
          * sufficient for any meaningful values.
          */
         aproperty->type      = BDF_PROPERTY_TYPE_INTEGER;
-        aproperty->u.integer = prop->value.integer;
+        aproperty->u.integer = (FT_Int32)prop->value.l;
       }
       return 0;
     }

src/pcf/pcfread.c

@@ -289,13 +289,13 @@ THE SOFTWARE.
   static FT_Error
   pcf_seek_to_table_type( FT_Stream  stream,
                           PCF_Table  tables,
-                          FT_Int     ntables,
+                          FT_ULong   ntables, /* same as PCF_Toc->count */
                           FT_ULong   type,
                           FT_ULong  *aformat,
                           FT_ULong  *asize )
   {
     FT_Error  error = PCF_Err_Invalid_File_Format;
-    FT_Int    i;
+    FT_ULong  i;
 
 
     for ( i = 0; i < ntables; i++ )
@@ -327,10 +327,10 @@ THE SOFTWARE.
 
   static FT_Bool
   pcf_has_table_type( PCF_Table  tables,
-                      FT_Int     ntables,
+                      FT_ULong   ntables, /* same as PCF_Toc->count */
                       FT_ULong   type )
   {
-    FT_Int  i;
+    FT_ULong  i;
 
 
     for ( i = 0; i < ntables; i++ )
@@ -399,7 +399,7 @@ THE SOFTWARE.
   {
     PCF_ParseProperty  props      = 0;
     PCF_Property       properties;
-    FT_UInt            nprops, i;
+    FT_ULong           nprops, i;
     FT_ULong           format, size;
     FT_Error           error;
     FT_Memory          memory     = FT_FACE(face)->memory;
@@ -433,7 +433,10 @@ THE SOFTWARE.
     if ( error )
       goto Bail;
 
-    FT_TRACE4(( "  nprop = %d\n", nprops ));
+    FT_TRACE4(( "  nprop = %d (truncate %d props)\n",
+                (int)nprops, nprops - (int)nprops ));
+
+    nprops = nprops - (int)nprops;
 
     /* rough estimate */
     if ( nprops > size / PCF_PROPERTY_SIZE )
@@ -442,7 +445,7 @@ THE SOFTWARE.
       goto Bail;
     }
 
-    face->nprops = nprops;
+    face->nprops = (int)nprops;
 
     if ( FT_NEW_ARRAY( props, nprops ) )
       goto Bail;
@@ -542,9 +545,9 @@ THE SOFTWARE.
       }
       else
       {
-        properties[i].value.integer = props[i].value;
+        properties[i].value.l = props[i].value;
 
-        FT_TRACE4(( " %d\n", properties[i].value.integer ));
+        FT_TRACE4(( " %d\n", properties[i].value.l ));
       }
     }
 
@@ -661,7 +664,7 @@ THE SOFTWARE.
     FT_Long*   offsets;
     FT_Long    bitmapSizes[GLYPHPADOPTIONS];
     FT_ULong   format, size;
-    int        nbitmaps, i, sizebitmaps = 0;
+    FT_ULong   nbitmaps, i, sizebitmaps = 0;
 
 
     error = pcf_seek_to_table_type( stream,
@@ -692,7 +695,8 @@ THE SOFTWARE.
 
     FT_TRACE4(( "  number of bitmaps: %d\n", nbitmaps ));
 
-    if ( nbitmaps != face->nmetrics )
+    /* XXX: PCF_Face->nmetrics is singed FT_Long, see pcf.h */
+    if ( face->nmetrics < 0 || nbitmaps != ( FT_ULong )face->nmetrics )
       return PCF_Err_Invalid_File_Format;
 
     if ( FT_NEW_ARRAY( offsets, nbitmaps ) )
@@ -992,9 +996,9 @@ THE SOFTWARE.
 
     PCF_Property  prop;
 
-    int    nn, len;
-    char*  strings[4] = { NULL, NULL, NULL, NULL };
-    int    lengths[4];
+    size_t  nn, len;
+    char*   strings[4] = { NULL, NULL, NULL, NULL };
+    size_t  lengths[4];
 
 
     face->style_flags = 0;
@@ -1076,7 +1080,7 @@ THE SOFTWARE.
         /* add_style_name and setwidth_name     */
         if ( nn == 0 || nn == 3 )
         {
-          int  mm;
+          size_t  mm;
 
 
           for ( mm = 0; mm < len; mm++ )
@@ -1201,7 +1205,7 @@ THE SOFTWARE.
 
         prop = pcf_find_property( face, "AVERAGE_WIDTH" );
         if ( prop )
-          bsize->width = (FT_Short)( ( prop->value.integer + 5 ) / 10 );
+          bsize->width = (FT_Short)( ( prop->value.l + 5 ) / 10 );
         else
           bsize->width = (FT_Short)( bsize->height * 2/3 );
 
@@ -1209,19 +1213,19 @@ THE SOFTWARE.
         if ( prop )
           /* convert from 722.7 decipoints to 72 points per inch */
           bsize->size =
-            (FT_Pos)( ( prop->value.integer * 64 * 7200 + 36135L ) / 72270L );
+            (FT_Pos)( ( prop->value.l * 64 * 7200 + 36135L ) / 72270L );
 
         prop = pcf_find_property( face, "PIXEL_SIZE" );
         if ( prop )
-          bsize->y_ppem = (FT_Short)prop->value.integer << 6;
+          bsize->y_ppem = (FT_Short)prop->value.l << 6;
 
         prop = pcf_find_property( face, "RESOLUTION_X" );
         if ( prop )
-          resolution_x = (FT_Short)prop->value.integer;
+          resolution_x = (FT_Short)prop->value.l;
 
         prop = pcf_find_property( face, "RESOLUTION_Y" );
         if ( prop )
-          resolution_y = (FT_Short)prop->value.integer;
+          resolution_y = (FT_Short)prop->value.l;
 
         if ( bsize->y_ppem == 0 )
         {

src/pcf/pcfutil.c

@@ -42,9 +42,9 @@ in this Software without prior written authorization from The Open Group.
 
   FT_LOCAL_DEF( void )
   BitOrderInvert( unsigned char*  buf,
-                  int             nbytes )
+                  size_t          nbytes )
   {
-    for ( ; --nbytes >= 0; buf++ )
+    for ( ; nbytes > 0; nbytes--, buf++ )
     {
       unsigned int  val = *buf;
 
@@ -64,7 +64,7 @@ in this Software without prior written authorization from The Open Group.
 
   FT_LOCAL_DEF( void )
   TwoByteSwap( unsigned char*  buf,
-               int             nbytes )
+               size_t          nbytes )
   {
     unsigned char  c;
 
@@ -83,7 +83,7 @@ in this Software without prior written authorization from The Open Group.
 
   FT_LOCAL_DEF( void )
   FourByteSwap( unsigned char*  buf,
-                int             nbytes )
+                size_t          nbytes )
   {
     unsigned char  c;
 

src/pcf/pcfutil.h

@@ -37,15 +37,15 @@ FT_BEGIN_HEADER
 
   FT_LOCAL( void )
   BitOrderInvert( unsigned char*  buf,
-                  int             nbytes );
+                  size_t          nbytes );
 
   FT_LOCAL( void )
   TwoByteSwap( unsigned char*  buf,
-               int             nbytes );
+               size_t          nbytes );
 
   FT_LOCAL( void )
   FourByteSwap( unsigned char*  buf,
-                int             nbytes );
+                size_t          nbytes );
 
 FT_END_HEADER
 

src/pfr/pfrcmap.c

@@ -88,7 +88,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   pfr_cmap_char_next( PFR_CMap    cmap,
                       FT_UInt32  *pchar_code )
   {

src/pfr/pfrload.c

@@ -716,7 +716,8 @@
   {
     FT_Error   error;
     FT_Memory  memory = stream->memory;
-    FT_UInt    flags, num_aux;
+    FT_UInt    flags;
+    FT_ULong   num_aux;
     FT_Byte*   p;
     FT_Byte*   limit;
 

src/pfr/pfrsbit.c

@@ -630,18 +630,35 @@
                                        &xpos, &ypos,
                                        &xsize, &ysize,
                                        &advance, &format );
+
+      /*
+       * XXX: on 16bit system, we return an error for huge bitmap
+       *      which causes a size truncation, because truncated
+       *      size properties makes bitmap glyph broken.
+       */
+      if ( xpos > FT_INT_MAX || ( ypos + ysize ) > FT_INT_MAX )
+      {
+        FT_TRACE1(( "pfr_slot_load_bitmap:" ));
+        FT_TRACE1(( "huge bitmap glyph %dx%d over FT_GlyphSlot\n",
+                     xpos, ypos ));
+        error = PFR_Err_Invalid_Pixel_Size;
+      }
+
       if ( !error )
       {
         glyph->root.format = FT_GLYPH_FORMAT_BITMAP;
 
         /* Set up glyph bitmap and metrics */
+
+        /* XXX: needs casts to fit FT_Bitmap.{width|rows|pitch} */
         glyph->root.bitmap.width      = (FT_Int)xsize;
         glyph->root.bitmap.rows       = (FT_Int)ysize;
-        glyph->root.bitmap.pitch      = (FT_Long)( xsize + 7 ) >> 3;
+        glyph->root.bitmap.pitch      = (FT_Int)( xsize + 7 ) >> 3;
         glyph->root.bitmap.pixel_mode = FT_PIXEL_MODE_MONO;
 
-        glyph->root.metrics.width        = (FT_Long)xsize << 6;
-        glyph->root.metrics.height       = (FT_Long)ysize << 6;
+        /* XXX: needs casts to fit FT_Glyph_Metrics.{width|height} */
+        glyph->root.metrics.width        = (FT_Pos)xsize << 6;
+        glyph->root.metrics.height       = (FT_Pos)ysize << 6;
         glyph->root.metrics.horiBearingX = xpos << 6;
         glyph->root.metrics.horiBearingY = ypos << 6;
         glyph->root.metrics.horiAdvance  = FT_PIX_ROUND( ( advance >> 2 ) );
@@ -649,8 +666,9 @@
         glyph->root.metrics.vertBearingY = 0;
         glyph->root.metrics.vertAdvance  = size->root.metrics.height;
 
-        glyph->root.bitmap_left = xpos;
-        glyph->root.bitmap_top  = ypos + ysize;
+        /* XXX: needs casts fit FT_GlyphSlotRec.bitmap_{left|top} */
+        glyph->root.bitmap_left = (FT_Int)xpos;
+        glyph->root.bitmap_top  = (FT_Int)(ypos + ysize);
 
         /* Allocate and read bitmap data */
         {

src/pfr/pfrtypes.h

@@ -200,7 +200,7 @@ FT_BEGIN_HEADER
     FT_Byte       flags;
     FT_Short      base_adj;
     FT_UInt       pair_size;
-    FT_UInt32     offset;
+    FT_Offset     offset;
     FT_UInt32     pair1;
     FT_UInt32     pair2;
 
@@ -252,7 +252,7 @@ FT_BEGIN_HEADER
     FT_UInt            blue_scale;
 
     FT_UInt            num_chars;
-    FT_UInt32          chars_offset;
+    FT_Offset          chars_offset;
     PFR_Char           chars;
 
     FT_UInt            num_kern_pairs;
@@ -260,7 +260,7 @@ FT_BEGIN_HEADER
     PFR_KernItem*      kern_items_tail;
 
     /* not part of the spec, but used during load */
-    FT_UInt32          bct_offset;
+    FT_Long            bct_offset;
     FT_Byte*           cursor;
 
   } PFR_PhyFontRec, *PFR_PhyFont;

src/psaux/afmparse.c

@@ -366,11 +366,11 @@
   FT_LOCAL_DEF( FT_Int )
   afm_parser_read_vals( AFM_Parser  parser,
                         AFM_Value   vals,
-                        FT_Int      n )
+                        FT_UInt     n )
   {
     AFM_Stream  stream = parser->stream;
     char*       str;
-    FT_Int      i;
+    FT_UInt     i;
 
 
     if ( n > AFM_MAX_ARGUMENTS )
@@ -378,7 +378,7 @@
 
     for ( i = 0; i < n; i++ )
     {
-      FT_UInt    len;
+      FT_Offset  len;
       AFM_Value  val = vals + i;
 
 
@@ -440,7 +440,7 @@
   FT_LOCAL_DEF( char* )
   afm_parser_next_key( AFM_Parser  parser,
                        FT_Bool     line,
-                       FT_UInt*    len )
+                       FT_Offset*  len )
   {
     AFM_Stream  stream = parser->stream;
     char*       key    = 0;  /* make stupid compiler happy */
@@ -488,7 +488,7 @@
     }
 
     if ( len )
-      *len = ( key ) ? AFM_STREAM_KEY_LEN( stream, key )
+      *len = ( key ) ? (FT_Offset)AFM_STREAM_KEY_LEN( stream, key )
                      : 0;
 
     return key;
@@ -497,7 +497,7 @@
 
   static AFM_Token
   afm_tokenize( const char*  key,
-                FT_UInt      len )
+                FT_Offset    len )
   {
     int  n;
 
@@ -585,7 +585,7 @@
     AFM_FontInfo   fi = parser->FontInfo;
     AFM_TrackKern  tk;
     char*          key;
-    FT_UInt        len;
+    FT_Offset      len;
     int            n = -1;
 
 
@@ -686,7 +686,7 @@
     AFM_FontInfo  fi = parser->FontInfo;
     AFM_KernPair  kp;
     char*         key;
-    FT_UInt       len;
+    FT_Offset     len;
     int           n = -1;
 
 
@@ -774,9 +774,9 @@
   static FT_Error
   afm_parse_kern_data( AFM_Parser  parser )
   {
-    FT_Error  error;
-    char*     key;
-    FT_UInt   len;
+    FT_Error   error;
+    char*      key;
+    FT_Offset  len;
 
 
     while ( ( key = afm_parser_next_key( parser, 1, &len ) ) != 0 )
@@ -818,8 +818,8 @@
                            FT_UInt     n,
                            AFM_Token   end_section )
   {
-    char*    key;
-    FT_UInt  len;
+    char*      key;
+    FT_Offset  len;
 
 
     while ( n-- > 0 )
@@ -850,7 +850,7 @@
     AFM_FontInfo  fi     = parser->FontInfo;
     FT_Error      error  = PSaux_Err_Syntax_Error;
     char*         key;
-    FT_UInt       len;
+    FT_Offset     len;
     FT_Int        metrics_sets = 0;
 
 

src/psaux/afmparse.h

@@ -71,13 +71,13 @@ FT_BEGIN_HEADER
   FT_LOCAL( FT_Int )
   afm_parser_read_vals( AFM_Parser  parser,
                         AFM_Value   vals,
-                        FT_Int      n );
+                        FT_UInt     n );
 
   /* read the next key from the next line or column */
   FT_LOCAL( char* )
   afm_parser_next_key( AFM_Parser  parser,
                        FT_Bool     line,
-                       FT_UInt*    len );
+                       FT_Offset*  len );
 
 FT_END_HEADER
 

src/psaux/psconv.c

@@ -239,7 +239,7 @@
   PS_Conv_StringDecode( FT_Byte**  cursor,
                         FT_Byte*   limit,
                         FT_Byte*   buffer,
-                        FT_UInt    n )
+                        FT_Offset  n )
   {
     FT_Byte*  p;
     FT_UInt   r = 0;
@@ -334,7 +334,7 @@
   PS_Conv_ASCIIHexDecode( FT_Byte**  cursor,
                           FT_Byte*   limit,
                           FT_Byte*   buffer,
-                          FT_UInt    n )
+                          FT_Offset  n )
   {
     FT_Byte*  p;
     FT_UInt   r   = 0;
@@ -423,7 +423,7 @@
   PS_Conv_EexecDecode( FT_Byte**   cursor,
                        FT_Byte*    limit,
                        FT_Byte*    buffer,
-                       FT_UInt     n,
+                       FT_Offset   n,
                        FT_UShort*  seed )
   {
     FT_Byte*  p;

src/psaux/psconv.h

@@ -46,20 +46,20 @@ FT_BEGIN_HEADER
   PS_Conv_StringDecode( FT_Byte**  cursor,
                         FT_Byte*   limit,
                         FT_Byte*   buffer,
-                        FT_UInt    n );
+                        FT_Offset  n );
 #endif
 
   FT_LOCAL( FT_UInt )
   PS_Conv_ASCIIHexDecode( FT_Byte**  cursor,
                           FT_Byte*   limit,
                           FT_Byte*   buffer,
-                          FT_UInt    n );
+                          FT_Offset  n );
 
   FT_LOCAL( FT_UInt )
   PS_Conv_EexecDecode( FT_Byte**   cursor,
                        FT_Byte*    limit,
                        FT_Byte*    buffer,
-                       FT_UInt     n,
+                       FT_Offset   n,
                        FT_UShort*  seed );
 
 

src/psaux/psobjs.c

@@ -1313,7 +1313,7 @@
   FT_LOCAL_DEF( FT_Error )
   ps_parser_to_bytes( PS_Parser  parser,
                       FT_Byte*   bytes,
-                      FT_Long    max_bytes,
+                      FT_Offset  max_bytes,
                       FT_Long*   pnum_bytes,
                       FT_Bool    delimiters )
   {

src/psaux/psobjs.h

@@ -111,7 +111,7 @@ FT_BEGIN_HEADER
   FT_LOCAL( FT_Error )
   ps_parser_to_bytes( PS_Parser  parser,
                       FT_Byte*   bytes,
-                      FT_Long    max_bytes,
+                      FT_Offset  max_bytes,
                       FT_Long*   pnum_bytes,
                       FT_Bool    delimiters );
 

src/psaux/t1cmap.c

@@ -95,7 +95,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   t1_cmap_std_char_next( T1_CMapStd   cmap,
                          FT_UInt32   *pchar_code )
   {
@@ -213,7 +213,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   t1_cmap_custom_char_next( T1_CMapCustom  cmap,
                             FT_UInt32     *pchar_code )
   {
@@ -312,7 +312,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   t1_cmap_unicode_char_next( PS_Unicodes  unicodes,
                              FT_UInt32   *pchar_code )
   {

src/psaux/t1decode.c

@@ -594,7 +594,7 @@
         if ( ip[-1] >= 32 )
         {
           if ( ip[-1] < 247 )
-            value = (FT_Long)ip[-1] - 139;
+            value = (FT_Int32)ip[-1] - 139;
           else
           {
             if ( ++ip > limit )
@@ -605,9 +605,9 @@
             }
 
             if ( ip[-2] < 251 )
-              value =  ( ( (FT_Long)ip[-2] - 247 ) << 8 ) + ip[-1] + 108;
+              value =  ( ( (FT_Int32)ip[-2] - 247 ) << 8 ) + ip[-1] + 108;
             else
-              value = -( ( ( (FT_Long)ip[-2] - 251 ) << 8 ) + ip[-1] + 108 );
+              value = -( ( ( (FT_Int32)ip[-2] - 251 ) << 8 ) + ip[-1] + 108 );
           }
 
           if ( !large_int )

src/psnames/psmodule.c

@@ -34,7 +34,7 @@
 
 
 #define VARIANT_BIT         0x80000000UL
-#define BASE_GLYPH( code )  ( (code) & ~VARIANT_BIT )
+#define BASE_GLYPH( code )  ( (FT_UInt32)( (code) & ~VARIANT_BIT ) )
 
 
   /* Return the Unicode value corresponding to a given glyph.  Note that */
@@ -58,7 +58,7 @@
       /*      `uniXXXXYYYYZZZZ'...                                   */
 
       FT_Int       count;
-      FT_ULong     value = 0;
+      FT_UInt32    value = 0;
       const char*  p     = glyph_name + 3;
 
 
@@ -93,7 +93,7 @@
         if ( *p == '\0' )
           return value;
         if ( *p == '.' )
-          return value | VARIANT_BIT;
+          return (FT_UInt32)( value | VARIANT_BIT );
       }
     }
 
@@ -102,7 +102,7 @@
     if ( glyph_name[0] == 'u' )
     {
       FT_Int       count;
-      FT_ULong     value = 0;
+      FT_UInt32    value = 0;
       const char*  p     = glyph_name + 1;
 
 
@@ -133,7 +133,7 @@
         if ( *p == '\0' )
           return value;
         if ( *p == '.' )
-          return value | VARIANT_BIT;
+          return (FT_UInt32)( value | VARIANT_BIT );
       }
     }
 
@@ -155,9 +155,10 @@
 
       /* now look up the glyph in the Adobe Glyph List */
       if ( !dot )
-        return ft_get_adobe_glyph_index( glyph_name, p );
+        return (FT_UInt32)ft_get_adobe_glyph_index( glyph_name, p );
       else
-        return ft_get_adobe_glyph_index( glyph_name, dot ) | VARIANT_BIT;
+        return (FT_UInt32)( ft_get_adobe_glyph_index( glyph_name, dot ) |
+                            VARIANT_BIT );
     }
   }
 
@@ -436,7 +437,7 @@
   }
 
 
-  static FT_ULong
+  static FT_UInt32
   ps_unicodes_char_next( PS_Unicodes  table,
                          FT_UInt32   *unicode )
   {

src/sfnt/sfdriver.c

@@ -49,6 +49,15 @@
 #include FT_SERVICE_SFNT_H
 #include FT_SERVICE_TT_CMAP_H
 
+  /*************************************************************************/
+  /*                                                                       */
+  /* The macro FT_COMPONENT is used in trace mode.  It is an implicit      */
+  /* parameter of the FT_TRACE() and FT_ERROR() macros, used to print/log  */
+  /* messages during execution.                                            */
+  /*                                                                       */
+#undef  FT_COMPONENT
+#define FT_COMPONENT  trace_sfdriver
+
 
  /*
   *  SFNT TABLE SERVICE
@@ -157,11 +166,19 @@
   sfnt_get_name_index( TT_Face     face,
                        FT_String*  glyph_name )
   {
-    FT_Face  root = &face->root;
-    FT_Long  i;
+    FT_Face   root = &face->root;
+    FT_UInt   i, max_gid = FT_UINT_MAX;
 
 
-    for ( i = 0; i < root->num_glyphs; i++ )
+    if ( root->num_glyphs < 0 )
+      return 0;
+    else if ( ( FT_ULong ) root->num_glyphs < FT_UINT_MAX )
+      max_gid = ( FT_UInt ) root->num_glyphs;
+    else
+      FT_TRACE0(( "Ignore glyph names for invalid GID 0x%08x - 0x%08x\n",
+         FT_UINT_MAX, root->num_glyphs ));
+
+    for ( i = 0; i < max_gid; i++ )
     {
       FT_String*  gname;
       FT_Error    error = tt_face_get_ps_name( face, i, &gname );
@@ -171,7 +188,7 @@
         continue;
 
       if ( !ft_strcmp( glyph_name, gname ) )
-        return (FT_UInt)i;
+        return i;
     }
 
     return 0;

src/sfnt/sfobjs.c

@@ -749,8 +749,8 @@
 
     /* now set up root fields */
     {
-      FT_Face   root  = &face->root;
-      FT_Int32  flags = root->face_flags;
+      FT_Face  root  = &face->root;
+      FT_Long  flags = root->face_flags;
 
 
       /*********************************************************************/

src/sfnt/ttbdf.c

@@ -84,7 +84,7 @@
       FT_Byte*   p           = bdf->table;
       FT_UInt    version     = FT_NEXT_USHORT( p );
       FT_UInt    num_strikes = FT_NEXT_USHORT( p );
-      FT_UInt32  strings     = FT_NEXT_ULONG ( p );
+      FT_ULong   strings     = FT_NEXT_ULONG ( p );
       FT_UInt    count;
       FT_Byte*   strike;
 
@@ -141,13 +141,13 @@
                          const char*       property_name,
                          BDF_PropertyRec  *aprop )
   {
-    TT_BDF    bdf   = &face->bdf;
-    FT_Size   size  = FT_FACE(face)->size;
-    FT_Error  error = 0;
-    FT_Byte*  p;
-    FT_UInt   count;
-    FT_Byte*  strike;
-    FT_UInt   property_len;
+    TT_BDF     bdf   = &face->bdf;
+    FT_Size    size  = FT_FACE(face)->size;
+    FT_Error   error = 0;
+    FT_Byte*   p;
+    FT_UInt    count;
+    FT_Byte*   strike;
+    FT_Offset  property_len;
 
 
     aprop->type = BDF_PROPERTY_TYPE_NONE;

src/sfnt/ttcmap.c

@@ -125,7 +125,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap0_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
@@ -460,7 +460,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap2_char_next( TT_CMap     cmap,
                       FT_UInt32  *pcharcode )
   {
@@ -659,7 +659,7 @@
 
     p                  = table + 6;
     cmap->num_ranges   = FT_PEEK_USHORT( p ) >> 1;
-    cmap->cur_charcode = 0xFFFFFFFFUL;
+    cmap->cur_charcode = (FT_UInt32)0xFFFFFFFFUL;
     cmap->cur_gindex   = 0;
 
     return SFNT_Err_Ok;
@@ -737,7 +737,7 @@
     if ( cmap->cur_charcode >= 0xFFFFUL )
       goto Fail;
 
-    charcode = cmap->cur_charcode + 1;
+    charcode = (FT_UInt)cmap->cur_charcode + 1;
 
     if ( charcode < cmap->cur_start )
       charcode = cmap->cur_start;
@@ -799,7 +799,7 @@
     }
 
   Fail:
-    cmap->cur_charcode = 0xFFFFFFFFUL;
+    cmap->cur_charcode = (FT_UInt32)0xFFFFFFFFUL;
     cmap->cur_gindex   = 0;
   }
 
@@ -1088,7 +1088,7 @@
     FT_UInt   num_segs2, start, end, offset;
     FT_Int    delta;
     FT_UInt   max, min, mid, num_segs;
-    FT_UInt   charcode = *pcharcode;
+    FT_UInt   charcode = (FT_UInt)*pcharcode;
     FT_UInt   gindex   = 0;
     FT_Byte*  p;
 
@@ -1330,7 +1330,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap4_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
@@ -1481,7 +1481,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap6_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
@@ -1734,7 +1734,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap8_char_next( TT_CMap     cmap,
                       FT_UInt32  *pchar_code )
   {
@@ -1892,7 +1892,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap10_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
@@ -2210,7 +2210,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap12_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
@@ -2228,8 +2228,10 @@
       if ( cmap12->valid )
       {
         gindex = cmap12->cur_gindex;
+
+        /* XXX: check cur_charcode overflow is expected */
         if ( gindex )
-          *pchar_code = cmap12->cur_charcode;
+          *pchar_code = (FT_UInt32)cmap12->cur_charcode;
       }
       else
         gindex = 0;
@@ -2237,7 +2239,8 @@
     else
       gindex = tt_cmap12_char_map_binary( cmap, pchar_code, 1 );
 
-    return gindex;
+    /* XXX: check gindex overflow is expected */
+    return (FT_UInt32)gindex;
   }
 
 
@@ -2526,12 +2529,12 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap13_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
     TT_CMap13  cmap13 = (TT_CMap13)cmap;
-    FT_ULong   gindex;
+    FT_UInt    gindex;
 
 
     if ( cmap13->cur_charcode >= 0xFFFFFFFFUL )
@@ -2664,7 +2667,7 @@
      * cmap 14 query functions.  The data is overwritten
      * on each call to these functions.
      */
-    FT_UInt     max_results;
+    FT_UInt32   max_results;
     FT_UInt32*  results;
     FT_Memory   memory;
 
@@ -2685,10 +2688,10 @@
 
   static FT_Error
   tt_cmap14_ensure( TT_CMap14  cmap,
-                    FT_UInt    num_results,
+                    FT_UInt32  num_results,
                     FT_Memory  memory )
   {
-    FT_UInt   old_max = cmap->max_results;
+    FT_UInt32 old_max = cmap->max_results;
     FT_Error  error   = 0;
 
 
@@ -2834,7 +2837,7 @@
   }
 
 
-  FT_CALLBACK_DEF( FT_UInt )
+  FT_CALLBACK_DEF( FT_UInt32 )
   tt_cmap14_char_next( TT_CMap     cmap,
                        FT_UInt32  *pchar_code )
   {
@@ -2912,7 +2915,7 @@
     {
       FT_UInt32  mid = ( min + max ) >> 1;
       FT_Byte*   p   = base + 5 * mid;
-      FT_UInt32  uni = TT_NEXT_UINT24( p );
+      FT_UInt32  uni = (FT_UInt32)TT_NEXT_UINT24( p );
 
 
       if ( char_code < uni )
@@ -2961,10 +2964,10 @@
 
 
   FT_CALLBACK_DEF( FT_UInt )
-  tt_cmap14_char_var_index( TT_CMap   cmap,
-                            TT_CMap   ucmap,
-                            FT_ULong  charcode,
-                            FT_ULong  variantSelector)
+  tt_cmap14_char_var_index( TT_CMap    cmap,
+                            TT_CMap    ucmap,
+                            FT_UInt32  charcode,
+                            FT_UInt32  variantSelector)
   {
     FT_Byte*  p = tt_cmap14_find_variant( cmap->data + 6, variantSelector );
     FT_ULong  defOff;
@@ -2994,9 +2997,9 @@
 
 
   FT_CALLBACK_DEF( FT_Int )
-  tt_cmap14_char_var_isdefault( TT_CMap   cmap,
-                                FT_ULong  charcode,
-                                FT_ULong  variantSelector )
+  tt_cmap14_char_var_isdefault( TT_CMap    cmap,
+                                FT_UInt32  charcode,
+                                FT_UInt32  variantSelector )
   {
     FT_Byte*  p = tt_cmap14_find_variant( cmap->data + 6, variantSelector );
     FT_ULong  defOff;
@@ -3027,10 +3030,10 @@
                       FT_Memory  memory )
   {
     TT_CMap14   cmap14 = (TT_CMap14)cmap;
-    FT_UInt     count  = cmap14->num_selectors;
+    FT_UInt32   count  = cmap14->num_selectors;
     FT_Byte*    p      = cmap->data + 10;
     FT_UInt32*  result;
-    FT_UInt     i;
+    FT_UInt32   i;
 
 
     if ( tt_cmap14_ensure( cmap14, ( count + 1 ), memory ) )
@@ -3039,7 +3042,7 @@
     result = cmap14->results;
     for ( i = 0; i < count; ++i )
     {
-      result[i] = TT_NEXT_UINT24( p );
+      result[i] = (FT_UInt32)TT_NEXT_UINT24( p );
       p        += 8;
     }
     result[i] = 0;
@@ -3051,10 +3054,10 @@
   FT_CALLBACK_DEF( FT_UInt32 * )
   tt_cmap14_char_variants( TT_CMap    cmap,
                            FT_Memory  memory,
-                           FT_ULong   charCode )
+                           FT_UInt32  charCode )
   {
     TT_CMap14   cmap14 = (TT_CMap14)  cmap;
-    FT_UInt     count  = cmap14->num_selectors;
+    FT_UInt32   count  = cmap14->num_selectors;
     FT_Byte*    p      = cmap->data + 10;
     FT_UInt32*  q;
 
@@ -3089,7 +3092,7 @@
   static FT_UInt
   tt_cmap14_def_char_count( FT_Byte  *p )
   {
-    FT_UInt32  numRanges = TT_NEXT_ULONG( p );
+    FT_UInt32  numRanges = (FT_UInt32)TT_NEXT_ULONG( p );
     FT_UInt    tot       = 0;
 
 
@@ -3116,14 +3119,14 @@
 
 
     cnt       = tt_cmap14_def_char_count( p );
-    numRanges = TT_NEXT_ULONG( p );
+    numRanges = (FT_UInt32)TT_NEXT_ULONG( p );
 
     if ( tt_cmap14_ensure( cmap14, ( cnt + 1 ), memory ) )
       return NULL;
 
     for ( q = cmap14->results; numRanges > 0; --numRanges )
     {
-      FT_UInt  uni = TT_NEXT_UINT24( p );
+      FT_UInt32 uni = (FT_UInt32)TT_NEXT_UINT24( p );
 
 
       cnt = FT_NEXT_BYTE( p ) + 1;
@@ -3151,7 +3154,7 @@
     FT_UInt32  *ret;
 
 
-    numMappings = TT_NEXT_ULONG( p );
+    numMappings = (FT_UInt32)TT_NEXT_ULONG( p );
 
     if ( tt_cmap14_ensure( cmap14, ( numMappings + 1 ), memory ) )
       return NULL;
@@ -3159,7 +3162,7 @@
     ret = cmap14->results;
     for ( i = 0; i < numMappings; ++i )
     {
-      ret[i] = TT_NEXT_UINT24( p );
+      ret[i] = (FT_UInt32)TT_NEXT_UINT24( p );
       p += 2;
     }
     ret[i] = 0;
@@ -3171,7 +3174,7 @@
   FT_CALLBACK_DEF( FT_UInt32 * )
   tt_cmap14_variant_chars( TT_CMap    cmap,
                            FT_Memory  memory,
-                           FT_ULong   variantSelector )
+                           FT_UInt32  variantSelector )
   {
     FT_Byte    *p  = tt_cmap14_find_variant( cmap->data + 6,
                                              variantSelector );
@@ -3213,9 +3216,9 @@
       p  = cmap->data + nondefOff;
       dp = cmap->data + defOff;
 
-      numMappings = TT_NEXT_ULONG( p );
+      numMappings = (FT_UInt32)TT_NEXT_ULONG( p );
       dcnt        = tt_cmap14_def_char_count( dp );
-      numRanges   = TT_NEXT_ULONG( dp );
+      numRanges   = (FT_UInt32)TT_NEXT_ULONG( dp );
 
       if ( numMappings == 0 )
         return tt_cmap14_get_def_chars( cmap, cmap->data + defOff,
@@ -3228,10 +3231,10 @@
         return NULL;
 
       ret  = cmap14->results;
-      duni = TT_NEXT_UINT24( dp );
+      duni = (FT_UInt32)TT_NEXT_UINT24( dp );
       dcnt = FT_NEXT_BYTE( dp );
       di   = 1;
-      nuni = TT_NEXT_UINT24( p );
+      nuni = (FT_UInt32)TT_NEXT_UINT24( p );
       p   += 2;
       ni   = 1;
       i    = 0;
@@ -3248,7 +3251,7 @@
           if ( di > numRanges )
             break;
 
-          duni = TT_NEXT_UINT24( dp );
+          duni = (FT_UInt32)TT_NEXT_UINT24( dp );
           dcnt = FT_NEXT_BYTE( dp );
         }
         else
@@ -3261,7 +3264,7 @@
           if ( ni > numMappings )
             break;
 
-          nuni = TT_NEXT_UINT24( p );
+          nuni = (FT_UInt32)TT_NEXT_UINT24( p );
           p += 2;
         }
       }
@@ -3274,7 +3277,7 @@
         ret[i++] = nuni;
         while ( ni < numMappings )
         {
-          ret[i++] = TT_NEXT_UINT24( p );
+          ret[i++] = (FT_UInt32)TT_NEXT_UINT24( p );
           p += 2;
           ++ni;
         }
@@ -3289,7 +3292,7 @@
 
         while ( di < numRanges )
         {
-          duni = TT_NEXT_UINT24( dp );
+          duni = (FT_UInt32)TT_NEXT_UINT24( dp );
           dcnt = FT_NEXT_BYTE( dp );
 
           for ( k = 0; k <= dcnt; ++k )

src/sfnt/ttkern.c

@@ -87,7 +87,7 @@
     {
       FT_UInt    num_pairs, length, coverage;
       FT_Byte*   p_next;
-      FT_UInt32  mask = 1UL << nn;
+      FT_UInt32  mask = (FT_UInt32)1UL << nn;
 
 
       if ( p + 6 > p_limit )
@@ -126,8 +126,8 @@
        */
       if ( num_pairs > 0 )
       {
-        FT_UInt  count;
-        FT_UInt  old_pair;
+        FT_ULong  count;
+        FT_ULong  old_pair;
 
 
         old_pair = FT_NEXT_ULONG( p );

src/smooth/ftgrays.c

@@ -275,7 +275,7 @@
   /* need to define them to "float" or "double" when experimenting with   */
   /* new algorithms                                                       */
 
-  typedef int   TCoord;   /* integer scanline/pixel coordinate */
+  typedef long  TCoord;   /* integer scanline/pixel coordinate */
   typedef long  TPos;     /* sub-pixel coordinate              */
 
   /* determine the type used to store cell areas.  This normally takes at */
@@ -306,8 +306,8 @@
 
   typedef struct  TCell_
   {
-    int    x;
-    int    cover;
+    TPos   x;     /* same with TWorker.ex */
+    TCoord cover; /* same with TWorker.cover */
     TArea  area;
     PCell  next;
 
@@ -322,12 +322,12 @@
     TPos    count_ex, count_ey;
 
     TArea   area;
-    int     cover;
+    TCoord  cover;
     int     invalid;
 
     PCell   cells;
-    int     max_cells;
-    int     num_cells;
+    FT_PtrDist  max_cells;
+    FT_PtrDist  num_cells;
 
     TCoord  cx, cy;
     TPos    x,  y;
@@ -359,7 +359,7 @@
     long        buffer_size;
 
     PCell*     ycells;
-    int        ycount;
+    TPos       ycount;
 
   } TWorker, *PWorker;
 
@@ -456,7 +456,7 @@
   gray_find_cell( RAS_ARG )
   {
     PCell  *pcell, cell;
-    int     x = ras.ex;
+    TPos    x = ras.ex;
 
 
     if ( x > ras.count_ex )
@@ -588,9 +588,9 @@
                                  TPos    x2,
                                  TCoord  y2 )
   {
-    TCoord  ex1, ex2, fx1, fx2, delta;
+    TCoord  ex1, ex2, fx1, fx2, delta, mod, lift, rem;
     long    p, first, dx;
-    int     incr, lift, mod, rem;
+    int     incr;
 
 
     dx = x2 - x1;
@@ -612,7 +612,7 @@
     if ( ex1 == ex2 )
     {
       delta      = y2 - y1;
-      ras.area  += (TArea)( fx1 + fx2 ) * delta;
+      ras.area  += (TArea)(( fx1 + fx2 ) * delta);
       ras.cover += delta;
       return;
     }
@@ -640,7 +640,7 @@
       mod += (TCoord)dx;
     }
 
-    ras.area  += (TArea)( fx1 + first ) * delta;
+    ras.area  += (TArea)(( fx1 + first ) * delta);
     ras.cover += delta;
 
     ex1 += incr;
@@ -670,7 +670,7 @@
           delta++;
         }
 
-        ras.area  += (TArea)ONE_PIXEL * delta;
+        ras.area  += (TArea)(ONE_PIXEL * delta);
         ras.cover += delta;
         y1        += delta;
         ex1       += incr;
@@ -679,7 +679,7 @@
     }
 
     delta      = y2 - y1;
-    ras.area  += (TArea)( fx2 + ONE_PIXEL - first ) * delta;
+    ras.area  += (TArea)(( fx2 + ONE_PIXEL - first ) * delta);
     ras.cover += delta;
   }
 
@@ -692,10 +692,10 @@
   gray_render_line( RAS_ARG_ TPos  to_x,
                              TPos  to_y )
   {
-    TCoord  ey1, ey2, fy1, fy2;
+    TCoord  ey1, ey2, fy1, fy2, mod;
     TPos    dx, dy, x, x2;
     long    p, first;
-    int     delta, rem, mod, lift, incr;
+    int     delta, rem, lift, incr;
 
 
     ey1 = TRUNC( ras.last_ey );
@@ -739,7 +739,7 @@
     {
       TCoord  ex     = TRUNC( ras.x );
       TCoord  two_fx = (TCoord)( ( ras.x - SUBPIXELS( ex ) ) << 1 );
-      TPos    area;
+      TArea   area;
 
 
       first = ONE_PIXEL;
@@ -1231,7 +1231,7 @@
   gray_hline( RAS_ARG_ TCoord  x,
                        TCoord  y,
                        TPos    area,
-                       int     acount )
+                       TCoord  acount )
   {
     FT_Span*  span;
     int       count;
@@ -1271,6 +1271,10 @@
     if ( x >= 32767 )
       x = 32767;
 
+    /* FT_Span.y is an integer, so limit our coordinates appropriately */
+    if ( y >= FT_INT_MAX )
+      y = FT_INT_MAX;
+
     if ( coverage )
     {
       /* see whether we can add this span to the current list */
@@ -1309,7 +1313,7 @@
 #endif /* FT_DEBUG_LEVEL_TRACE */
 
         ras.num_gray_spans = 0;
-        ras.span_y         = y;
+        ras.span_y         = (int)y;
 
         count = 0;
         span  = ras.gray_spans;
@@ -1345,7 +1349,7 @@
       printf( "%3d:", yindex );
 
       for ( cell = ras.ycells[yindex]; cell != NULL; cell = cell->next )
-        printf( " (%3d, c:%4d, a:%6d)", cell->x, cell->cover, cell->area );
+        printf( " (%3ld, c:%4ld, a:%6d)", cell->x, cell->cover, cell->area );
       printf( "\n" );
     }
   }
@@ -1377,7 +1381,7 @@
 
       for ( ; cell != NULL; cell = cell->next )
       {
-        TArea  area;
+        TPos  area;
 
 
         if ( cell->x > x && cover != 0 )

src/smooth/ftsmooth.c

@@ -196,6 +196,10 @@
 
 #endif
 
+#if FT_UINT_MAX > 0xFFFFU
+
+  /* if pitch or height is not FT_UInt, check must be enabled */
+
     if ( pitch > 0xFFFF || height > 0xFFFF )
     {
       FT_ERROR(( "ft_smooth_render_generic: glyph too large: %d x %d\n",
@@ -203,6 +207,8 @@
       return Smooth_Err_Raster_Overflow;
     }
 
+#endif
+
     bitmap->pixel_mode = FT_PIXEL_MODE_GRAY;
     bitmap->num_grays  = 256;
     bitmap->width      = width;
@@ -319,12 +325,19 @@
 
     FT_Outline_Translate( outline, x_shift, y_shift );
 
+    /*
+     * XXX: on 16bit system, we return an error for huge bitmap
+     * to prevent an overflow.
+     */
+    if ( x_left > FT_INT_MAX || y_top > FT_INT_MAX )
+      return Smooth_Err_Invalid_Pixel_Size;
+
     if ( error )
       goto Exit;
 
     slot->format      = FT_GLYPH_FORMAT_BITMAP;
-    slot->bitmap_left = x_left;
-    slot->bitmap_top  = y_top;
+    slot->bitmap_left = (FT_Int)x_left;
+    slot->bitmap_top  = (FT_Int)y_top;
 
   Exit:
     if ( outline && origin )

src/tools/test_afm.c

@@ -63,7 +63,7 @@
 
   int
   dummy_get_index( const char*  name,
-                   FT_UInt      len,
+                   FT_Offset    len,
                    void*        user_data )
   {
     if ( len )