/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c

Bug Summary

File:	root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c
Warning:	line 3268, column 18 Access to field 'header' results in a dereference of a null pointer (loaded from variable 'font')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name cairo-cff-subset.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -ffp-contract=off -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/gfx/cairo/cairo/src -fcoverage-compilation-dir=/root/firefox-clang/obj-x86_64-pc-linux-gnu/gfx/cairo/cairo/src -resource-dir /usr/lib/llvm-21/lib/clang/21 -include /root/firefox-clang/config/gcc_hidden.h -include /root/firefox-clang/obj-x86_64-pc-linux-gnu/mozilla-config.h -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/system_wrappers -U _FORTIFY_SOURCE -D _FORTIFY_SOURCE=2 -D _GLIBCXX_ASSERTIONS -D DEBUG=1 -D HAVE_FT_LOAD_SFNT_TABLE -D PACKAGE_VERSION="moz" -D PACKAGE_BUGREPORT="http://bugzilla.mozilla.org/" -D CAIRO_HAS_PTHREAD -D _GNU_SOURCE -D MOZ_TREE_PIXMAN -D SIZEOF_VOID_P=__SIZEOF_POINTER__ -D SIZEOF_INT=__SIZEOF_INT__ -D SIZEOF_LONG=__SIZEOF_LONG__ -D SIZEOF_LONG_LONG=__SIZEOF_LONG_LONG__ -D HAVE_UINT64_T -D HAVE_CXX11_ATOMIC_PRIMITIVES -D MOZ_HAS_MOZGLUE -D MOZILLA_INTERNAL_API -D IMPL_LIBXUL -D MOZ_SUPPORT_LEAKCHECKING -D STATIC_EXPORTABLE_JS_API -I /root/firefox-clang/gfx/cairo/cairo/src -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/gfx/cairo/cairo/src -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nspr -I /root/firefox-clang/obj-x86_64-pc-linux-gnu/dist/include/nss -D MOZILLA_CLIENT -I /usr/include/freetype2 -I /usr/include/libpng16 -I /usr/include/freetype2 -I /usr/include/libpng16 -internal-isystem /usr/lib/llvm-21/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-error=tautological-type-limit-compare -Wno-range-loop-analysis -Wno-error=deprecated-declarations -Wno-error=array-bounds -Wno-error=free-nonheap-object -Wno-error=atomic-alignment -Wno-error=deprecated-builtins -Wno-psabi -Wno-error=builtin-macro-redefined -Wno-unknown-warning-option -Wno-enum-compare -Wno-int-to-pointer-cast -Wno-int-conversion -Wno-incompatible-pointer-types -Wno-sign-compare -Wno-type-limits -Wno-missing-field-initializers -Wno-conversion -Wno-narrowing -Wno-switch -Wno-unused -Wno-unused-variable -Wno-error=uninitialized -Wno-absolute-value -Wno-deprecated-register -Wno-incompatible-pointer-types -Wno-macro-redefined -Wno-shift-negative-value -Wno-tautological-compare -Wno-tautological-constant-out-of-range-compare -Wno-unreachable-code -ferror-limit 19 -fstrict-flex-arrays=1 -stack-protector 2 -fstack-clash-protection -ftrivial-auto-var-init=pattern -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2025-06-30-093548-1913035-1 -x c /root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c
1/* -*- Mode: c; tab-width: 8; c-basic-offset: 4; indent-tabs-mode: t; -*- */
2/* cairo - a vector graphics library with display and print output
*
* Copyright © 2006 Adrian Johnson
*
* This library is free software; you can redistribute it and/or
* modify it either under the terms of the GNU Lesser General Public
* License version 2.1 as published by the Free Software Foundation
* (the "LGPL") or, at your option, under the terms of the Mozilla
* Public License Version 1.1 (the "MPL"). If you do not alter this
* notice, a recipient may use your version of this file under either
* the MPL or the LGPL.
*
* You should have received a copy of the LGPL along with this library
* in the file COPYING-LGPL-2.1; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Suite 500, Boston, MA 02110-1335, USA
* You should have received a copy of the MPL along with this library
* in the file COPYING-MPL-1.1
*
* The contents of this file are subject to the Mozilla Public License
* Version 1.1 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY
* OF ANY KIND, either express or implied. See the LGPL or the MPL for
* the specific language governing rights and limitations.
*
* The Original Code is the cairo graphics library.
*
* The Initial Developer of the Original Code is Adrian Johnson.
*
* Contributor(s):
*	Adrian Johnson <ajohnson@redneon.com>
*      Eugeniy Meshcheryakov <eugen@debian.org>
*/

38/*
* Useful links:
* http://www.adobe.com/content/dam/Adobe/en/devnet/font/pdfs/5176.CFF.pdf
* http://www.adobe.com/content/dam/Adobe/en/devnet/font/pdfs/5177.Type2.pdf
*/

44#define _DEFAULT_SOURCE1 /* for snprintf(), strdup() */
45#include "cairoint.h"

47#include "cairo-array-private.h"
48#include "cairo-error-private.h"

50#if CAIRO_HAS_FONT_SUBSET1

52#include "cairo-scaled-font-subsets-private.h"
53#include "cairo-truetype-subset-private.h"
54#include <string.h>
55#include <locale.h>

57/* CFF Dict Operators. If the high byte is 0 the command is encoded
* with a single byte. */
59#define BASEFONTNAME_OP0x0c16     0x0c16
60#define CIDCOUNT_OP0x0c22         0x0c22
61#define CHARSET_OP0x000f          0x000f
62#define CHARSTRINGS_OP0x0011      0x0011
63#define COPYRIGHT_OP0x0c00        0x0c00
64#define DEFAULTWIDTH_OP0x0014     0x0014
65#define ENCODING_OP0x0010         0x0010
66#define FAMILYNAME_OP0x0003       0x0003
67#define FDARRAY_OP0x0c24          0x0c24
68#define FDSELECT_OP0x0c25         0x0c25
69#define FONTBBOX_OP0x0005         0x0005
70#define FONTMATRIX_OP0x0c07       0x0c07
71#define FONTNAME_OP0x0c26         0x0c26
72#define FULLNAME_OP0x0002         0x0002
73#define LOCAL_SUB_OP0x0013        0x0013
74#define NOMINALWIDTH_OP0x0015     0x0015
75#define NOTICE_OP0x0001           0x0001
76#define POSTSCRIPT_OP0x0c15       0x0c15
77#define PRIVATE_OP0x0012          0x0012
78#define ROS_OP0x0c1e              0x0c1e
79#define UNIQUEID_OP0x000d         0x000d
80#define VERSION_OP0x0000          0x0000
81#define WEIGHT_OP0x0004           0x0004
82#define XUID_OP0x000e             0x000e
83#define BLUEVALUES_OP0x0006       0x0006
84#define OTHERBLUES_OP0x0007       0x0007
85#define FAMILYBLUES_OP0x0008      0x0008
86#define FAMILYOTHERBLUES_OP0x0009 0x0009
87#define STEMSNAPH_OP0x0c0c        0x0c0c
88#define STEMSNAPV_OP0x0c0d        0x0c0d

90#define NUM_STD_STRINGS391 391

92/* Type 2 Charstring operators */
93#define TYPE2_hstem0x0001     0x0001
94#define TYPE2_vstem0x0003     0x0003
95#define TYPE2_callsubr0x000a  0x000a

97#define TYPE2_return0x000b    0x000b
98#define TYPE2_endchar0x000e   0x000e

100#define TYPE2_hstemhm0x0012   0x0012
101#define TYPE2_hintmask0x0013  0x0013
102#define TYPE2_cntrmask0x0014  0x0014
103#define TYPE2_vstemhm0x0017   0x0017
104#define TYPE2_callgsubr0x001d 0x001d

106#define TYPE2_rmoveto0x0015   0x0015
107#define TYPE2_hmoveto0x0016   0x0016
108#define TYPE2_vmoveto0x0004   0x0004


111#define MAX_SUBROUTINE_NESTING10 10 /* From Type2 Charstring spec */


114typedef struct _cff_header {
  uint8_t major;
  uint8_t minor;
  uint8_t header_size;
  uint8_t offset_size;
119} cff_header_t;

121typedef struct _cff_index_element {
  cairo_bool_t   is_copy;
  unsigned char *data;
  int            length;
125} cff_index_element_t;

127typedef struct _cff_dict_operator {
  cairo_hash_entry_t base;

  unsigned short operator;
  unsigned char *operand;
  int            operand_length;
  int            operand_offset;
134} cff_dict_operator_t;

136typedef struct _cairo_cff_font {

  cairo_scaled_font_subset_t *scaled_font_subset;
  const cairo_scaled_font_backend_t *backend;

  /* Font Data */
  unsigned char       *data;
  unsigned long        data_length;
  unsigned char       *current_ptr;
  unsigned char       *data_end;
  cff_header_t        *header;
  char                *font_name;
  char                *ps_name;
  cairo_hash_table_t  *top_dict;
  cairo_hash_table_t  *private_dict;
  cairo_array_t        strings_index;
  cairo_array_t        charstrings_index;
  cairo_array_t        global_sub_index;
  cairo_array_t        local_sub_index;
  unsigned char       *charset;
  int                  num_glyphs;
  cairo_bool_t         is_cid;
  cairo_bool_t         is_opentype;
  int  		 units_per_em;
  int 		 global_sub_bias;
  int			 local_sub_bias;
  double               default_width;
  double               nominal_width;

  /* CID Font Data */
  int                 *fdselect;
  unsigned int         num_fontdicts;
  cairo_hash_table_t **fd_dict;
  cairo_hash_table_t **fd_private_dict;
  cairo_array_t       *fd_local_sub_index;
  int			*fd_local_sub_bias;
  double              *fd_default_width;
  double              *fd_nominal_width;

  /* Subsetted Font Data */
  char                *subset_font_name;
  cairo_array_t        charstrings_subset_index;
  cairo_array_t        strings_subset_index;
  int			 euro_sid;
  int                 *fdselect_subset;
  unsigned int         num_subset_fontdicts;
  int                 *fd_subset_map;
  int                 *private_dict_offset;
  cairo_bool_t         subset_subroutines;
  cairo_bool_t	*global_subs_used;
  cairo_bool_t	*local_subs_used;
  cairo_bool_t       **fd_local_subs_used;
  cairo_array_t        output;

  /* Subset Metrics */
  int                 *widths;
  int                  x_min, y_min, x_max, y_max;
  int                  ascent, descent;

  /* Type 2 charstring data */
  int 	 	 type2_stack_size;
  int 		 type2_stack_top_value;
  cairo_bool_t 	 type2_stack_top_is_int;
  int 		 type2_num_hints;
  int 		 type2_hintmask_bytes;
  int                  type2_nesting_level;
  cairo_bool_t         type2_seen_first_int;
  cairo_bool_t         type2_find_width;
  cairo_bool_t         type2_found_width;
  int                  type2_width;
  cairo_bool_t         type2_has_path;

208} cairo_cff_font_t;

210/* Encoded integer using maximum sized encoding. This is required for
* operands that are later modified after encoding. */
212static unsigned char *
213encode_integer_max (unsigned char *p, int i)
214{
  *p++ = 29;
  *p++ = i >> 24;
  *p++ = (i >> 16) & 0xff;
  *p++ = (i >> 8)  & 0xff;
  *p++ = i & 0xff;
  return p;
221}

223static unsigned char *
224encode_integer (unsigned char *p, int i)
225{
  if (i >= -107 && i <= 107) {
      *p++ = i + 139;
  } else if (i >= 108 && i <= 1131) {
      i -= 108;
      *p++ = (i >> 8)+ 247;
      *p++ = i & 0xff;
  } else if (i >= -1131 && i <= -108) {
      i = -i - 108;
      *p++ = (i >> 8)+ 251;
      *p++ = i & 0xff;
  } else if (i >= -32768 && i <= 32767) {
      *p++ = 28;
      *p++ = (i >> 8)  & 0xff;
      *p++ = i & 0xff;
  } else {
      p = encode_integer_max (p, i);
  }
  return p;
244}

246static unsigned char *
247decode_integer (unsigned char *p, int *integer)
248{
  if (*p == 28) {
      *integer = (int16_t)(p[1]<<8 | p[2]);
      p += 3;
  } else if (*p == 29) {
      *integer = (int32_t)(((uint32_t)p[1] << 24) | (p[2] << 16) | (p[3] << 8) | p[4]);
      p += 5;
  } else if (*p >= 32 && *p <= 246) {
      *integer = *p++ - 139;
  } else if (*p <= 250) {
      *integer = (p[0] - 247) * 256 + p[1] + 108;
      p += 2;
  } else if (*p <= 254) {
      *integer = -(p[0] - 251) * 256 - p[1] - 108;
      p += 2;
  } else {
      *integer = 0;
      p += 1;
  }
  return p;
268}

270static char *
271decode_nibble (int n, char *buf)
272{
  switch (n)
  {
  case 0xa:
*buf++ = '.';
break;
  case 0xb:
*buf++ = 'E';
break;
  case 0xc:
*buf++ = 'E';
*buf++ = '-';
break;
  case 0xd:
*buf++ = '-';
break;
  case 0xe:
*buf++ = '-';
break;
  case 0xf:
break;
  default:
*buf++ = '0' + n;
break;
  }

  return buf;
299}

301static unsigned char *
302decode_real (unsigned char *p, double *real)
303{
  char buffer[100];
  char *buf = buffer;
  char *buf_end = buffer + sizeof (buffer);
  char *end;
  int n;

  p++;
  while (buf + 2 < buf_end) {
n = *p >> 4;
buf = decode_nibble (n, buf);
n = *p & 0x0f;
buf = decode_nibble (n, buf);
      if ((*p & 0x0f) == 0x0f) {
   p++;
          break;
}
p++;
  };
  *buf = 0;

  *real = _cairo_strtod (buffer, &end);

  return p;
327}

329static unsigned char *
330decode_number (unsigned char *p, double *number)
331{
  if (*p == 30) {
      p = decode_real (p, number);
  } else {
      int i;
      p = decode_integer (p, &i);
      *number = i;
  }
  return p;
340}

342static unsigned char *
343decode_operator (unsigned char *p, unsigned short *operator)
344{
  unsigned short op = 0;

  op = *p++;
  if (op == 12) {
      op <<= 8;
      op |= *p++;
  }
  *operator = op;
  return p;
354}

356/* return 0 if not an operand */
357static int
358operand_length (unsigned char *p)
359{
  unsigned char *begin = p;

  if (*p == 28)
      return 3;

  if (*p == 29)
      return 5;

  if (*p >= 32 && *p <= 246)
      return 1;

  if (*p >= 247 && *p <= 254)
      return 2;

  if (*p == 30) {
      while ((*p & 0x0f) != 0x0f)
          p++;
      return p - begin + 1;
  }

  return 0;
381}

383static unsigned char *
384encode_index_offset (unsigned char *p, int offset_size, unsigned long offset)
385{
  while (--offset_size >= 0) {
      p[offset_size] = (unsigned char) (offset & 0xff);
      offset >>= 8;
  }
  return p + offset_size;
391}

393static size_t
394decode_index_offset(unsigned char *p, int off_size)
395{
  unsigned long offset = 0;

  while (off_size-- > 0)
      offset = offset*256 + *p++;
  return offset;
401}

403static void
404cff_index_init (cairo_array_t *index)
405{
  _cairo_array_init (index, sizeof (cff_index_element_t));
407}

409static cairo_int_status_t
410cff_index_read (cairo_array_t *index, unsigned char **ptr, unsigned char *end_ptr)
411{
  cff_index_element_t element;
  unsigned char *data, *p;
  cairo_status_t status;
  int offset_size, count, i;
  size_t start, end = 0;

  p = *ptr;
  if (p + 2 > end_ptr)
      return CAIRO_INT_STATUS_UNSUPPORTED;
  count = get_unaligned_be16 (p);
  p += 2;
  if (count > 0) {
      offset_size = *p++;
      if (p + (count + 1)*offset_size > end_ptr || offset_size > 4)
          return CAIRO_INT_STATUS_UNSUPPORTED;
      data = p + offset_size*(count + 1) - 1;
      start = decode_index_offset (p, offset_size);
      p += offset_size;
      for (i = 0; i < count; i++) {
          end = decode_index_offset (p, offset_size);
          p += offset_size;
          if (p > end_ptr || end < start || data + end > end_ptr)
              return CAIRO_INT_STATUS_UNSUPPORTED;
          element.length = end - start;
          element.is_copy = FALSE0;
          element.data = data + start;
          status = _cairo_array_append (index, &element);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
          start = end;
      }
      p = data + end;
  }
  *ptr = p;

  return CAIRO_STATUS_SUCCESS;
448}

450static cairo_status_t
451cff_index_write (cairo_array_t *index, cairo_array_t *output)
452{
  int offset_size;
  int offset;
  int num_elem;
  int i;
  cff_index_element_t *element;
  uint16_t count;
  unsigned char buf[5];
  cairo_status_t status;

  num_elem = _cairo_array_num_elements (index);
  count = cpu_to_be16 ((uint16_t) num_elem);
  status = _cairo_array_append_multiple (output, &count, 2);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (num_elem == 0)
      return CAIRO_STATUS_SUCCESS;

  /* Find maximum offset to determine offset size */
  offset = 1;
  for (i = 0; i < num_elem; i++) {
      element = _cairo_array_index (index, i);
      offset += element->length;
  }
  if (offset < 0x100)
      offset_size = 1;
  else if (offset < 0x10000)
      offset_size = 2;
  else if (offset < 0x1000000)
      offset_size = 3;
  else
      offset_size = 4;

  buf[0] = (unsigned char) offset_size;
  status = _cairo_array_append (output, buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  offset = 1;
  encode_index_offset (buf, offset_size, offset);
  status = _cairo_array_append_multiple (output, buf, offset_size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  for (i = 0; i < num_elem; i++) {
      element = _cairo_array_index (index, i);
      offset += element->length;
      encode_index_offset (buf, offset_size, offset);
      status = _cairo_array_append_multiple (output, buf, offset_size);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  for (i = 0; i < num_elem; i++) {
      element = _cairo_array_index (index, i);
      if (element->length > 0) {
          status = _cairo_array_append_multiple (output,
                                                 element->data,
                                                 element->length);
      }
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }
  return CAIRO_STATUS_SUCCESS;
517}

519static void
520cff_index_set_object (cairo_array_t *index, int obj_index,
                    unsigned char *object , int length)
522{
  cff_index_element_t *element;

  element = _cairo_array_index (index, obj_index);
  if (element->is_copy)
      free (element->data);

  element->data = object;
  element->length = length;
  element->is_copy = FALSE0;
532}

534static cairo_status_t
535cff_index_append (cairo_array_t *index, unsigned char *object , int length)
536{
  cff_index_element_t element;

  element.length = length;
  element.is_copy = FALSE0;
  element.data = object;

  return _cairo_array_append (index, &element);
544}

546static cairo_status_t
547cff_index_append_copy (cairo_array_t *index,
                     const unsigned char *object,
                     unsigned int length)
550{
  cff_index_element_t element;
  cairo_status_t status;

  element.length = length;
  element.is_copy = TRUE1;
  element.data = _cairo_malloc (element.length)((element.length) != 0 ? malloc(element.length) : ((void*)0));
  if (unlikely (element.data == NULL && length != 0)(__builtin_expect (!!(element.data == ((void*)0) && length
 != 0), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  memcpy (element.data, object, element.length);

  status = _cairo_array_append (index, &element);
  if (unlikely (status)(__builtin_expect (!!(status), 0))) {
free (element.data);
return status;
  }

  return CAIRO_STATUS_SUCCESS;
569}

571static void
572cff_index_fini (cairo_array_t *index)
573{
  cff_index_element_t *element;
  unsigned int i;

  for (i = 0; i < _cairo_array_num_elements (index); i++) {
      element = _cairo_array_index (index, i);
      if (element->is_copy && element->data)
          free (element->data);
  }
  _cairo_array_fini (index);
583}

585static cairo_bool_t
586_cairo_cff_dict_equal (const void *key_a, const void *key_b)
587{
  const cff_dict_operator_t *op_a = key_a;
  const cff_dict_operator_t *op_b = key_b;

  return op_a->operator == op_b->operator;
592}

594static cairo_status_t
595cff_dict_init (cairo_hash_table_t **dict)
596{
  *dict = _cairo_hash_table_create (_cairo_cff_dict_equal);
  if (unlikely (*dict == NULL)(__builtin_expect (!!(*dict == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  return CAIRO_STATUS_SUCCESS;
602}

604static void
605_cairo_dict_init_key (cff_dict_operator_t *key, int operator)
606{
  key->base.hash = (unsigned long) operator;
  key->operator = operator;
609}

611static cairo_status_t
612cff_dict_create_operator (int            operator,
                        unsigned char *operand,
                        int            size,
	  cff_dict_operator_t **out)
616{
  cff_dict_operator_t *op;

  op = _cairo_malloc (sizeof (cff_dict_operator_t))((sizeof (cff_dict_operator_t)) != 0 ? malloc(sizeof (cff_dict_operator_t
)) : ((void*)0));
  if (unlikely (op == NULL)(__builtin_expect (!!(op == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  _cairo_dict_init_key (op, operator);
  if (size != 0) {
op->operand = _cairo_malloc (size)((size) != 0 ? malloc(size) : ((void*)0));
if (unlikely (op->operand == NULL)(__builtin_expect (!!(op->operand == ((void*)0)), 0))) {
   free (op);
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);
}
memcpy (op->operand, operand, size);
  } else {
op->operand = NULL((void*)0);
/* Delta-encoded arrays can be empty. */
if (operator != BLUEVALUES_OP0x0006 &&
   operator != OTHERBLUES_OP0x0007 &&
   operator != FAMILYBLUES_OP0x0008 &&
   operator != FAMILYOTHERBLUES_OP0x0009 &&
   operator != STEMSNAPH_OP0x0c0c &&
   operator != STEMSNAPV_OP0x0c0d) {
   free (op);
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);
}
  }

  op->operand_length = size;
  op->operand_offset = -1;

  *out = op;
  return CAIRO_STATUS_SUCCESS;
650}

652static cairo_status_t
653cff_dict_read (cairo_hash_table_t *dict, unsigned char *p, int dict_size)
654{
  unsigned char *end;
  cairo_array_t operands;
  cff_dict_operator_t *op;
  unsigned short operator;
  cairo_status_t status = CAIRO_STATUS_SUCCESS;
  int size;

  end = p + dict_size;
  _cairo_array_init (&operands, 1);
  while (p < end) {
      size = operand_length (p);
      if (size != 0) {
          status = _cairo_array_append_multiple (&operands, p, size);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              goto fail;

          p += size;
      } else {
          p = decode_operator (p, &operator);
          status = cff_dict_create_operator (operator,
                                        _cairo_array_index (&operands, 0),
                                        _cairo_array_num_elements (&operands),
			  &op);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              goto fail;

          status = _cairo_hash_table_insert (dict, &op->base);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              goto fail;

          _cairo_array_truncate (&operands, 0);
      }
  }

689fail:
  _cairo_array_fini (&operands);

  return status;
693}

695static void
696cff_dict_remove (cairo_hash_table_t *dict, unsigned short operator)
697{
  cff_dict_operator_t key, *op;

  _cairo_dict_init_key (&key, operator);
  op = _cairo_hash_table_lookup (dict, &key.base);
  if (op != NULL((void*)0)) {
      free (op->operand);
      _cairo_hash_table_remove (dict, (cairo_hash_entry_t *) op);
      free (op);
  }
707}

709static unsigned char *
710cff_dict_get_operands (cairo_hash_table_t *dict,
                     unsigned short      operator,
                     int                *size)
713{
  cff_dict_operator_t key, *op;

  _cairo_dict_init_key (&key, operator);
  op = _cairo_hash_table_lookup (dict, &key.base);
  if (op != NULL((void*)0)) {
      *size = op->operand_length;
      return op->operand;
  }

  return NULL((void*)0);
724}

726static cairo_status_t
727cff_dict_set_operands (cairo_hash_table_t *dict,
                     unsigned short      operator,
                     unsigned char      *operand,
                     int                 size)
731{
  cff_dict_operator_t key, *op;
  cairo_status_t status;

  _cairo_dict_init_key (&key, operator);
  op = _cairo_hash_table_lookup (dict, &key.base);
  if (op != NULL((void*)0)) {
      free (op->operand);
      op->operand = _cairo_malloc (size)((size) != 0 ? malloc(size) : ((void*)0));
if (unlikely (op->operand == NULL)(__builtin_expect (!!(op->operand == ((void*)0)), 0)))
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);

      memcpy (op->operand, operand, size);
      op->operand_length = size;
  }
  else
  {
      status = cff_dict_create_operator (operator, operand, size, &op);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

status = _cairo_hash_table_insert (dict, &op->base);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }

  return CAIRO_STATUS_SUCCESS;
758}

760static int
761cff_dict_get_location (cairo_hash_table_t *dict,
                     unsigned short      operator,
                     int                *size)
764{
  cff_dict_operator_t key, *op;

  _cairo_dict_init_key (&key, operator);
  op = _cairo_hash_table_lookup (dict, &key.base);
  if (op != NULL((void*)0)) {
      *size = op->operand_length;
      return op->operand_offset;
  }

  return -1;
775}

777typedef struct _dict_write_info {
  cairo_array_t *output;
  cairo_status_t status;
780} dict_write_info_t;

782static void
783cairo_dict_write_operator (cff_dict_operator_t *op, dict_write_info_t *write_info)
784{
  unsigned char data;

  op->operand_offset = _cairo_array_num_elements (write_info->output);
  write_info->status = _cairo_array_append_multiple (write_info->output, op->operand, op->operand_length);
  if (write_info->status)
      return;

  if (op->operator & 0xff00) {
      data = op->operator >> 8;
      write_info->status = _cairo_array_append (write_info->output, &data);
      if (write_info->status)
          return;
  }
  data = op->operator & 0xff;
  write_info->status = _cairo_array_append (write_info->output, &data);
800}

802static void
803_cairo_dict_collect (void *entry, void *closure)
804{
  dict_write_info_t   *write_info = closure;
  cff_dict_operator_t *op = entry;

  if (write_info->status)
      return;

  /* The ROS operator is handled separately in cff_dict_write() */
  if (op->operator != ROS_OP0x0c1e)
      cairo_dict_write_operator (op, write_info);
814}

816static cairo_status_t
817cff_dict_write (cairo_hash_table_t *dict, cairo_array_t *output)
818{
  dict_write_info_t write_info;
  cff_dict_operator_t key, *op;

  write_info.output = output;
  write_info.status = CAIRO_STATUS_SUCCESS;

  /* The CFF specification requires that the Top Dict of CID fonts
   * begin with the ROS operator. */
  _cairo_dict_init_key (&key, ROS_OP0x0c1e);
  op = _cairo_hash_table_lookup (dict, &key.base);
  if (op != NULL((void*)0))
      cairo_dict_write_operator (op, &write_info);

  _cairo_hash_table_foreach (dict, _cairo_dict_collect, &write_info);

  return write_info.status;
835}

837static void
838_cff_dict_entry_pluck (void *_entry, void *dict)
839{
  cff_dict_operator_t *entry = _entry;

  _cairo_hash_table_remove (dict, &entry->base);
  free (entry->operand);
  free (entry);
845}

847static void
848cff_dict_fini (cairo_hash_table_t *dict)
849{
  _cairo_hash_table_foreach (dict, _cff_dict_entry_pluck, dict);
  _cairo_hash_table_destroy (dict);
852}

854static cairo_int_status_t
855cairo_cff_font_read_header (cairo_cff_font_t *font)
856{
  if (font->data_length < sizeof (cff_header_t))
      return CAIRO_INT_STATUS_UNSUPPORTED;


  font->header = (cff_header_t *) font->data;
  font->current_ptr = font->data + font->header->header_size;

  return CAIRO_STATUS_SUCCESS;
865}

867static cairo_int_status_t
868cairo_cff_font_read_name (cairo_cff_font_t *font)
869{
  cairo_array_t index;
  cairo_int_status_t status;
  cff_index_element_t *element;
  unsigned char *p;
  int i, len;

  cff_index_init (&index);
  status = cff_index_read (&index, &font->current_ptr, font->data_end);
  if (status == CAIRO_INT_STATUS_SUCCESS && !font->is_opentype) {
      element = _cairo_array_index (&index, 0);
p = element->data;
len = element->length;

/* If font name is prefixed with a subset tag, strip it off. */
if (len > 7 && p[6] == '+') {
   for (i = 0; i < 6; i++)
if (p[i] < 'A' || p[i] > 'Z')
    break;
   if (i == 6) {
p += 7;
len -= 7;
   }
}

font->ps_name = _cairo_strndupstrndup ((char*)p, len);
if (unlikely (font->ps_name == NULL)(__builtin_expect (!!(font->ps_name == ((void*)0)), 0)))
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);

      status = _cairo_escape_ps_name (&font->ps_name);
  }
  cff_index_fini (&index);

  return status;
903}

905static cairo_int_status_t
906cairo_cff_font_read_private_dict (cairo_cff_font_t   *font,
                                cairo_hash_table_t *private_dict,
                                cairo_array_t      *local_sub_index,
                                int                *local_sub_bias,
                                cairo_bool_t      **local_subs_used,
                                double             *default_width,
                                double             *nominal_width,
                                unsigned char      *ptr,
                                int                 size)
915{
  cairo_int_status_t status;
  unsigned char buf[10];
  unsigned char *end_buf;
  int offset;
  int i;
  unsigned char *operand;
  unsigned char *p;
  int num_subs;

  status = cff_dict_read (private_dict, ptr, size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  operand = cff_dict_get_operands (private_dict, LOCAL_SUB_OP0x0013, &i);
  if (operand) {
      decode_integer (operand, &offset);
      p = ptr + offset;
      status = cff_index_read (local_sub_index, &p, font->data_end);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

/* Use maximum sized encoding to reserve space for later modification. */
end_buf = encode_integer_max (buf, 0);
status = cff_dict_set_operands (private_dict, LOCAL_SUB_OP0x0013, buf, end_buf - buf);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }

  *default_width = 0;
  operand = cff_dict_get_operands (private_dict, DEFAULTWIDTH_OP0x0014, &i);
  if (operand)
      decode_number (operand, default_width);

  *nominal_width = 0;
  operand = cff_dict_get_operands (private_dict, NOMINALWIDTH_OP0x0015, &i);
  if (operand)
decode_number (operand, nominal_width);

  num_subs = _cairo_array_num_elements (local_sub_index);
  *local_subs_used = calloc (num_subs, sizeof (cairo_bool_t));
  if (unlikely (*local_subs_used == NULL)(__builtin_expect (!!(*local_subs_used == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  if (num_subs < 1240)
*local_sub_bias = 107;
  else if (num_subs < 33900)
*local_sub_bias = 1131;
  else
*local_sub_bias = 32768;

  return CAIRO_STATUS_SUCCESS;
967}

969static cairo_int_status_t
970cairo_cff_font_read_fdselect (cairo_cff_font_t *font, unsigned char *p)
971{
  int type, num_ranges, first, last, fd, i, j;

  font->fdselect = calloc (font->num_glyphs, sizeof (int));
  if (unlikely (font->fdselect == NULL)(__builtin_expect (!!(font->fdselect == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  type = *p++;
  if (type == 0)
  {
      for (i = 0; i < font->num_glyphs; i++)
          font->fdselect[i] = *p++;
  } else if (type == 3) {
      num_ranges = get_unaligned_be16 (p);
      p += 2;
      for  (i = 0; i < num_ranges; i++)
      {
          first = get_unaligned_be16 (p);
          p += 2;
          fd = *p++;
          last = get_unaligned_be16 (p);
          if (last > font->num_glyphs)
              return CAIRO_INT_STATUS_UNSUPPORTED;
          for (j = first; j < last; j++)
              font->fdselect[j] = fd;
      }
  } else {
      return CAIRO_INT_STATUS_UNSUPPORTED;
  }

  return CAIRO_STATUS_SUCCESS;
1002}

1004static cairo_int_status_t
1005cairo_cff_font_read_cid_fontdict (cairo_cff_font_t *font, unsigned char *ptr)
1006{
  cairo_array_t index;
  cff_index_element_t *element;
  unsigned int i;
  int size;
  unsigned char *operand;
  int offset;
  cairo_int_status_t status;
  unsigned char buf[100];
  unsigned char *end_buf;

  cff_index_init (&index);
  status = cff_index_read (&index, &ptr, font->data_end);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail;

  font->num_fontdicts = _cairo_array_num_elements (&index);

  font->fd_dict = calloc (sizeof (cairo_hash_table_t *), font->num_fontdicts);
  if (unlikely (font->fd_dict == NULL)(__builtin_expect (!!(font->fd_dict == ((void*)0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_private_dict = calloc (sizeof (cairo_hash_table_t *), font->num_fontdicts);
  if (unlikely (font->fd_private_dict == NULL)(__builtin_expect (!!(font->fd_private_dict == ((void*)0))
, 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_local_sub_index = calloc (sizeof (cairo_array_t), font->num_fontdicts);
  if (unlikely (font->fd_local_sub_index == NULL)(__builtin_expect (!!(font->fd_local_sub_index == ((void*)
0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_local_sub_bias = calloc (sizeof (int), font->num_fontdicts);
  if (unlikely (font->fd_local_sub_bias == NULL)(__builtin_expect (!!(font->fd_local_sub_bias == ((void*)0
)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_local_subs_used = calloc (sizeof (cairo_bool_t *), font->num_fontdicts);
  if (unlikely (font->fd_local_subs_used == NULL)(__builtin_expect (!!(font->fd_local_subs_used == ((void*)
0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_default_width = calloc (font->num_fontdicts, sizeof (double));
  if (unlikely (font->fd_default_width == NULL)(__builtin_expect (!!(font->fd_default_width == ((void*)0)
), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  font->fd_nominal_width = calloc (font->num_fontdicts, sizeof (double));
  if (unlikely (font->fd_nominal_width == NULL)(__builtin_expect (!!(font->fd_nominal_width == ((void*)0)
), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail;
  }

  for (i = 0; i < font->num_fontdicts; i++) {
      status = cff_dict_init (&font->fd_dict[i]);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

      element = _cairo_array_index (&index, i);
      status = cff_dict_read (font->fd_dict[i], element->data, element->length);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

      operand = cff_dict_get_operands (font->fd_dict[i], PRIVATE_OP0x0012, &size);
      if (operand == NULL((void*)0)) {
          status = CAIRO_INT_STATUS_UNSUPPORTED;
          goto fail;
      }
      operand = decode_integer (operand, &size);
      decode_integer (operand, &offset);
      status = cff_dict_init (&font->fd_private_dict[i]);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

      cff_index_init (&font->fd_local_sub_index[i]);
      status = cairo_cff_font_read_private_dict (font,
                                                 font->fd_private_dict[i],
                                                 &font->fd_local_sub_index[i],
                                                 &font->fd_local_sub_bias[i],
                                                 &font->fd_local_subs_used[i],
                                                 &font->fd_default_width[i],
                                                 &font->fd_nominal_width[i],
                                                 font->data + offset,
                                                 size);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

/* Set integer operand to max value to use max size encoding to reserve
       * space for any value later */
      end_buf = encode_integer_max (buf, 0);
      end_buf = encode_integer_max (end_buf, 0);
      status = cff_dict_set_operands (font->fd_dict[i], PRIVATE_OP0x0012, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;
  }

  status = CAIRO_STATUS_SUCCESS;

1111fail:
  cff_index_fini (&index);

  return status;
1115}

1117static void
1118cairo_cff_font_read_font_metrics (cairo_cff_font_t *font, cairo_hash_table_t  *top_dict)
1119{
  unsigned char *p;
  unsigned char *end;
  int size;
  double x_min, y_min, x_max, y_max;
  double xx, yx, xy, yy;

  x_min = 0.0;
  y_min = 0.0;
  x_max = 0.0;
  y_max = 0.0;
  p = cff_dict_get_operands (font->top_dict, FONTBBOX_OP0x0005, &size);
  if (p) {
      end = p + size;
      if (p < end)
          p = decode_number (p, &x_min);
      if (p < end)
          p = decode_number (p, &y_min);
      if (p < end)
          p = decode_number (p, &x_max);
      if (p < end)
          p = decode_number (p, &y_max);
  }
  font->x_min = floor (x_min);
  font->y_min = floor (y_min);
  font->x_max = floor (x_max);
  font->y_max = floor (y_max);
  font->ascent = font->y_max;
  font->descent = font->y_min;

  xx = 0.001;
  yx = 0.0;
  xy = 0.0;
  yy = 0.001;
  p = cff_dict_get_operands (font->top_dict, FONTMATRIX_OP0x0c07, &size);
  if (p) {
      end = p + size;
      if (p < end)
          p = decode_number (p, &xx);
      if (p < end)
          p = decode_number (p, &yx);
      if (p < end)
          p = decode_number (p, &xy);
      if (p < end)
          p = decode_number (p, &yy);
  }
  /* FreeType uses 1/abs(yy) to get units per EM */
  font->units_per_em = _cairo_round(1.0/fabs(yy));
1167}

1169static cairo_int_status_t
1170cairo_cff_font_read_top_dict (cairo_cff_font_t *font)
1171{
  cairo_array_t index;
  cff_index_element_t *element;
  unsigned char buf[20];
  unsigned char *end_buf;
  unsigned char *operand;
  cairo_int_status_t status;
  unsigned char *p;
  int size;
  int offset;

  cff_index_init (&index);
  status = cff_index_read (&index, &font->current_ptr, font->data_end);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail;

  element = _cairo_array_index (&index, 0);
  if (element == NULL((void*)0))
      return CAIRO_STATUS_NO_MEMORY;
  status = cff_dict_read (font->top_dict, element->data, element->length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail;

  if (cff_dict_get_operands (font->top_dict, ROS_OP0x0c1e, &size) != NULL((void*)0))
      font->is_cid = TRUE1;
  else
      font->is_cid = FALSE0;

  operand = cff_dict_get_operands (font->top_dict, CHARSTRINGS_OP0x0011, &size);
  decode_integer (operand, &offset);
  p = font->data + offset;
  status = cff_index_read (&font->charstrings_index, &p, font->data_end);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail;
  font->num_glyphs = _cairo_array_num_elements (&font->charstrings_index);

  if (font->is_cid) {
operand = cff_dict_get_operands (font->top_dict, CHARSET_OP0x000f, &size);
if (!operand)
     return CAIRO_INT_STATUS_UNSUPPORTED;

decode_integer (operand, &offset);
font->charset = font->data + offset;
if (font->charset >= font->data_end)
     return CAIRO_INT_STATUS_UNSUPPORTED;
  }

  if (!font->is_opentype)
      cairo_cff_font_read_font_metrics (font, font->top_dict);

  if (font->is_cid) {
      operand = cff_dict_get_operands (font->top_dict, FDSELECT_OP0x0c25, &size);
      decode_integer (operand, &offset);
      status = cairo_cff_font_read_fdselect (font, font->data + offset);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail;

      operand = cff_dict_get_operands (font->top_dict, FDARRAY_OP0x0c24, &size);
      decode_integer (operand, &offset);
      status = cairo_cff_font_read_cid_fontdict (font, font->data + offset);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail;
  } else {
      operand = cff_dict_get_operands (font->top_dict, PRIVATE_OP0x0012, &size);
      operand = decode_integer (operand, &size);
      decode_integer (operand, &offset);
status = cairo_cff_font_read_private_dict (font,
                                                 font->private_dict,
				   &font->local_sub_index,
				   &font->local_sub_bias,
				   &font->local_subs_used,
                                                 &font->default_width,
                                                 &font->nominal_width,
				   font->data + offset,
				   size);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail;
  }

  /* Use maximum sized encoding to reserve space for later modification. */
  end_buf = encode_integer_max (buf, 0);
  status = cff_dict_set_operands (font->top_dict,
                           CHARSTRINGS_OP0x0011, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail;

  status = cff_dict_set_operands (font->top_dict,
                           CHARSET_OP0x000f, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail;

  if (font->scaled_font_subset->is_latin) {
      status = cff_dict_set_operands (font->top_dict,
                                      ENCODING_OP0x0010, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

/* Private has two operands - size and offset */
end_buf = encode_integer_max (end_buf, 0);
cff_dict_set_operands (font->top_dict, PRIVATE_OP0x0012, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

  } else {
      status = cff_dict_set_operands (font->top_dict,
                                      FDSELECT_OP0x0c25, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

      status = cff_dict_set_operands (font->top_dict,
                                      FDARRAY_OP0x0c24, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          goto fail;

      cff_dict_remove (font->top_dict, ENCODING_OP0x0010);
      cff_dict_remove (font->top_dict, PRIVATE_OP0x0012);
  }

  /* Remove the unique identifier operators as the subsetted font is
   * not the same is the original font. */
  cff_dict_remove (font->top_dict, UNIQUEID_OP0x000d);
  cff_dict_remove (font->top_dict, XUID_OP0x000e);

1294fail:
  cff_index_fini (&index);

  return status;
1298}

1300static cairo_int_status_t
1301cairo_cff_font_read_strings (cairo_cff_font_t *font)
1302{
  return cff_index_read (&font->strings_index, &font->current_ptr, font->data_end);
1304}

1306static cairo_int_status_t
1307cairo_cff_font_read_global_subroutines (cairo_cff_font_t *font)
1308{
  cairo_int_status_t status;
  int num_subs;

  status = cff_index_read (&font->global_sub_index, &font->current_ptr, font->data_end);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  num_subs = _cairo_array_num_elements (&font->global_sub_index);
  font->global_subs_used = calloc (num_subs, sizeof(cairo_bool_t));
  if (unlikely (font->global_subs_used == NULL)(__builtin_expect (!!(font->global_subs_used == ((void*)0)
), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  if (num_subs < 1240)
      font->global_sub_bias = 107;
  else if (num_subs < 33900)
      font->global_sub_bias = 1131;
  else
      font->global_sub_bias = 32768;

  return CAIRO_STATUS_SUCCESS;
1329}

1331typedef cairo_int_status_t
1332(*font_read_t) (cairo_cff_font_t *font);

1334static const font_read_t font_read_funcs[] = {
  cairo_cff_font_read_header,
  cairo_cff_font_read_name,
  cairo_cff_font_read_top_dict,
  cairo_cff_font_read_strings,
  cairo_cff_font_read_global_subroutines,
1340};

1342static cairo_int_status_t
1343cairo_cff_font_read_font (cairo_cff_font_t *font)
1344{
  cairo_int_status_t status;
  unsigned int i;

  for (i = 0; i < ARRAY_LENGTH (font_read_funcs)((int) (sizeof (font_read_funcs) / sizeof (font_read_funcs[0]
))); i++) {
      status = font_read_funcs[i] (font);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  return CAIRO_STATUS_SUCCESS;
1355}

1357static cairo_status_t
1358cairo_cff_font_set_ros_strings (cairo_cff_font_t *font)
1359{
  cairo_status_t status;
  unsigned char buf[30];
  unsigned char *p;
  int sid1, sid2;
  const char *registry = "Adobe";
  const char *ordering = "Identity";

  sid1 = NUM_STD_STRINGS391 + _cairo_array_num_elements (&font->strings_subset_index);
  status = cff_index_append_copy (&font->strings_subset_index,
                                  (unsigned char *)registry,
                                  strlen(registry));
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  sid2 = NUM_STD_STRINGS391 + _cairo_array_num_elements (&font->strings_subset_index);
  status = cff_index_append_copy (&font->strings_subset_index,
                                  (unsigned char *)ordering,
		    strlen(ordering));
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  p = encode_integer (buf, sid1);
  p = encode_integer (p, sid2);
  p = encode_integer (p, 0);
  status = cff_dict_set_operands (font->top_dict, ROS_OP0x0c1e, buf, p - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  p = encode_integer (buf, font->scaled_font_subset->num_glyphs);
  status = cff_dict_set_operands (font->top_dict, CIDCOUNT_OP0x0c22, buf, p - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  return CAIRO_STATUS_SUCCESS;
1394}

1396static cairo_status_t
1397cairo_cff_font_subset_dict_string(cairo_cff_font_t   *font,
                                cairo_hash_table_t *dict,
                                int                 operator)
1400{
  int size;
  unsigned char *p;
  int sid;
  unsigned char buf[100];
  cff_index_element_t *element;
  cairo_status_t status;

  p = cff_dict_get_operands (dict, operator, &size);
  if (!p)
      return CAIRO_STATUS_SUCCESS;

  decode_integer (p, &sid);
  if (sid < NUM_STD_STRINGS391)
      return CAIRO_STATUS_SUCCESS;

  element = _cairo_array_index (&font->strings_index, sid - NUM_STD_STRINGS391);
  sid = NUM_STD_STRINGS391 + _cairo_array_num_elements (&font->strings_subset_index);
  status = cff_index_append (&font->strings_subset_index, element->data, element->length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  p = encode_integer (buf, sid);
  status = cff_dict_set_operands (dict, operator, buf, p - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  return CAIRO_STATUS_SUCCESS;
1428}

1430static const int dict_strings[] = {
  VERSION_OP0x0000,
  NOTICE_OP0x0001,
  COPYRIGHT_OP0x0c00,
  FULLNAME_OP0x0002,
  FAMILYNAME_OP0x0003,
  WEIGHT_OP0x0004,
  POSTSCRIPT_OP0x0c15,
  BASEFONTNAME_OP0x0c16,
  FONTNAME_OP0x0c26,
1440};

1442static cairo_status_t
1443cairo_cff_font_subset_dict_strings (cairo_cff_font_t   *font,
                                  cairo_hash_table_t *dict)
1445{
  cairo_status_t status;
  unsigned int i;

  for (i = 0; i < ARRAY_LENGTH (dict_strings)((int) (sizeof (dict_strings) / sizeof (dict_strings[0]))); i++) {
      status = cairo_cff_font_subset_dict_string (font, dict, dict_strings[i]);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  return CAIRO_STATUS_SUCCESS;
1456}

1458static unsigned char *
1459type2_decode_integer (unsigned char *p, int *integer)
1460{
  if (*p == 28) {
*integer = p[1] << 8 | p[2];
p += 3;
  } else if (*p <= 246) {
      *integer = *p++ - 139;
  } else if (*p <= 250) {
      *integer = (p[0] - 247) * 256 + p[1] + 108;
      p += 2;
  } else if (*p <= 254) {
      *integer = -(p[0] - 251) * 256 - p[1] - 108;
      p += 2;
  } else { /* *p == 255 */
/* 16.16 fixed-point number. The fraction is ignored. */
*integer = (int16_t)((p[1] << 8) | p[2]);
      p += 5;
  }
  return p;
1478}

1480/* Type 2 charstring parser for finding calls to local or global
* subroutines. For non Opentype CFF fonts it also gets the glyph
* widths.
*
* When we find a subroutine operator, the subroutine is marked as in
* use and recursively followed. The subroutine number is the value on
* the top of the stack when the subroutine operator is executed. In
* most fonts the subroutine number is encoded in an integer
* immediately preceding the subroutine operator. However it is
* possible for the subroutine number on the stack to be the result of
* a computation (in which case there will be an operator preceding
* the subroutine operator). If this occurs, subroutine subsetting is
* disabled since we can't easily determine which subroutines are
* used.
*
* The width, if present, is the first integer in the charstring. The
* only way to confirm if the integer at the start of the charstring is
* the width is when the first stack clearing operator is parsed,
* check if there is an extra integer left over on the stack.
*
* When the first stack clearing operator is encountered
* type2_find_width is set to FALSE and type2_found_width is set to
* TRUE if an extra argument is found, otherwise FALSE.
*/
1504static cairo_status_t
1505cairo_cff_parse_charstring (cairo_cff_font_t *font,
                          unsigned char *charstring, int length,
                          int glyph_id,
	    cairo_bool_t need_width)
1509{
  unsigned char *p = charstring;
  unsigned char *end = charstring + length;
  int integer;
  int hint_bytes;
  int sub_num;
  cff_index_element_t *element;
  int fd;

  while (p < end) {
      if (*p == 28 || *p >= 32) {
          /* Integer value */
          p = type2_decode_integer (p, &integer);
          font->type2_stack_size++;
          font->type2_stack_top_value = integer;
          font->type2_stack_top_is_int = TRUE1;
   if (!font->type2_seen_first_int) {
font->type2_width = integer;
font->type2_seen_first_int = TRUE1;
   }
} else if (*p == TYPE2_hstem0x0001 || *p == TYPE2_vstem0x0003 ||
   *p == TYPE2_hstemhm0x0012 || *p == TYPE2_vstemhm0x0017) {
          /* Hint operator. The number of hints declared by the
           * operator depends on the size of the stack. */
   font->type2_stack_top_is_int = FALSE0;
   font->type2_num_hints += font->type2_stack_size/2;
   if (font->type2_find_width && font->type2_stack_size % 2)
font->type2_found_width = TRUE1;

   font->type2_stack_size = 0;
   font->type2_find_width = FALSE0;
   p++;
} else if (*p == TYPE2_hintmask0x0013 || *p == TYPE2_cntrmask0x0014) {
   /* Hintmask operator. These operators are followed by a
    * variable length mask where the length depends on the
    * number of hints declared. The first time this is called
    * it is also an implicit vstem if there are arguments on
    * the stack. */
   if (font->type2_hintmask_bytes == 0) {
font->type2_stack_top_is_int = FALSE0;
font->type2_num_hints += font->type2_stack_size/2;
if (font->type2_find_width && font->type2_stack_size % 2)
    font->type2_found_width = TRUE1;

font->type2_stack_size = 0;
font->type2_find_width = FALSE0;
font->type2_hintmask_bytes = (font->type2_num_hints+7)/8;
   }

   hint_bytes = font->type2_hintmask_bytes;
   p++;
   p += hint_bytes;
} else if (*p == TYPE2_rmoveto0x0015) {
   if (font->type2_find_width && font->type2_stack_size > 2)
font->type2_found_width = TRUE1;

   font->type2_stack_size = 0;
   font->type2_find_width = FALSE0;
   font->type2_has_path = TRUE1;
   p++;
} else if (*p == TYPE2_hmoveto0x0016 || *p == TYPE2_vmoveto0x0004) {
   if (font->type2_find_width && font->type2_stack_size > 1)
font->type2_found_width = TRUE1;

   font->type2_stack_size = 0;
   font->type2_find_width = FALSE0;
   font->type2_has_path = TRUE1;
   p++;
} else if (*p == TYPE2_endchar0x000e) {
   if (!font->type2_has_path && font->type2_stack_size > 3)
return CAIRO_INT_STATUS_UNSUPPORTED; /* seac (Ref Appendix C of Type 2 Charstring Format */

   if (font->type2_find_width && font->type2_stack_size > 0)
font->type2_found_width = TRUE1;

   return CAIRO_STATUS_SUCCESS;
      } else if (*p == TYPE2_callsubr0x000a) {
          /* call to local subroutine */
   if (! font->type2_stack_top_is_int)
return CAIRO_INT_STATUS_UNSUPPORTED;

          if (++font->type2_nesting_level > MAX_SUBROUTINE_NESTING10)
return CAIRO_INT_STATUS_UNSUPPORTED;

          p++;
   font->type2_stack_top_is_int = FALSE0;
          font->type2_stack_size--;
   if (font->type2_find_width && font->type2_stack_size == 0)
font->type2_seen_first_int = FALSE0;

          if (font->is_cid) {
              fd = font->fdselect[glyph_id];
sub_num = font->type2_stack_top_value + font->fd_local_sub_bias[fd];
if (sub_num >= (int)_cairo_array_num_elements(&font->fd_local_sub_index[fd]))
    return CAIRO_INT_STATUS_UNSUPPORTED;
              element = _cairo_array_index (&font->fd_local_sub_index[fd], sub_num);
              if (! font->fd_local_subs_used[fd][sub_num]) {
    font->fd_local_subs_used[fd][sub_num] = TRUE1;
    cairo_cff_parse_charstring (font, element->data, element->length, glyph_id, need_width);
}
          } else {
sub_num = font->type2_stack_top_value + font->local_sub_bias;
if (sub_num >= (int)_cairo_array_num_elements(&font->local_sub_index))
    return CAIRO_INT_STATUS_UNSUPPORTED;
              element = _cairo_array_index (&font->local_sub_index, sub_num);
              if (! font->local_subs_used[sub_num] ||
    (need_width && !font->type2_found_width))
{
    font->local_subs_used[sub_num] = TRUE1;
    cairo_cff_parse_charstring (font, element->data, element->length, glyph_id, need_width);
}
          }
          font->type2_nesting_level--;
      } else if (*p == TYPE2_callgsubr0x001d) {
          /* call to global subroutine */
   if (! font->type2_stack_top_is_int)
return CAIRO_INT_STATUS_UNSUPPORTED;

          if (++font->type2_nesting_level > MAX_SUBROUTINE_NESTING10)
return CAIRO_INT_STATUS_UNSUPPORTED;

          p++;
          font->type2_stack_size--;
   font->type2_stack_top_is_int = FALSE0;
   if (font->type2_find_width && font->type2_stack_size == 0)
font->type2_seen_first_int = FALSE0;

   sub_num = font->type2_stack_top_value + font->global_sub_bias;
   if (sub_num >= (int)_cairo_array_num_elements(&font->global_sub_index))
return CAIRO_INT_STATUS_UNSUPPORTED;
   element = _cairo_array_index (&font->global_sub_index, sub_num);
          if (! font->global_subs_used[sub_num] ||
(need_width && !font->type2_found_width))
   {
              font->global_subs_used[sub_num] = TRUE1;
              cairo_cff_parse_charstring (font, element->data, element->length, glyph_id, need_width);
          }
          font->type2_nesting_level--;
      } else if (*p == 12) {
          /* 2 byte instruction */

   /* All the 2 byte operators are either not valid before a
    * stack clearing operator or they are one of the
    * arithmetic, storage, or conditional operators. */
   if (need_width && font->type2_find_width)
return CAIRO_INT_STATUS_UNSUPPORTED;

          p += 2;
   font->type2_stack_top_is_int = FALSE0;
} else {
          /* 1 byte instruction */
          p++;
   font->type2_stack_top_is_int = FALSE0;
      }
  }

  return CAIRO_STATUS_SUCCESS;
1666}

1668static cairo_status_t
1669cairo_cff_find_width_and_subroutines_used (cairo_cff_font_t  *font,
			   unsigned char *charstring, int length,
			   int glyph_id, int subset_id)
1672{
  cairo_status_t status;
  int width;
  int fd;

  font->type2_stack_size = 0;
  font->type2_stack_top_value = 0;;
  font->type2_stack_top_is_int = FALSE0;
  font->type2_num_hints = 0;
  font->type2_hintmask_bytes = 0;
  font->type2_nesting_level = 0;
  font->type2_seen_first_int = FALSE0;
  font->type2_find_width = TRUE1;
  font->type2_found_width = FALSE0;
  font->type2_width = 0;
  font->type2_has_path = FALSE0;

  status = cairo_cff_parse_charstring (font, charstring, length, glyph_id, TRUE1);
  if (status)
return status;

  if (!font->is_opentype) {
      if (font->is_cid) {
          fd = font->fdselect[glyph_id];
          if (font->type2_found_width)
              width = font->fd_nominal_width[fd] + font->type2_width;
          else
              width = font->fd_default_width[fd];
      } else {
          if (font->type2_found_width)
              width = font->nominal_width + font->type2_width;
          else
              width = font->default_width;
      }
      font->widths[subset_id] = width;
  }

  return CAIRO_STATUS_SUCCESS;
1710}

1712static cairo_int_status_t
1713cairo_cff_font_get_gid_for_cid (cairo_cff_font_t  *font, unsigned long cid, unsigned long *gid)
1714{
  unsigned char *p;
  unsigned long first_gid;
  unsigned long first_cid;
  int num_left;
  unsigned long c, g;

  if (cid == 0) {
*gid = 0;
return CAIRO_STATUS_SUCCESS;
  }

  switch (font->charset[0]) {
/* Format 0 */
case 0:
   p = font->charset + 1;
   g = 1;
   while (g <= (unsigned)font->num_glyphs && p < font->data_end) {
c = get_unaligned_be16 (p);
if (c == cid) {
    *gid = g;
    return CAIRO_STATUS_SUCCESS;
}
g++;
p += 2;
   }
   break;

/* Format 1 */
case 1:
   first_gid = 1;
   p = font->charset + 1;
   while (first_gid <= (unsigned)font->num_glyphs && p + 2 < font->data_end) {
first_cid = get_unaligned_be16 (p);
num_left = p[2];
if (cid >= first_cid && cid <= first_cid + num_left) {
    *gid = first_gid + cid - first_cid;
    return CAIRO_STATUS_SUCCESS;
}
first_gid += num_left + 1;
p += 3;
   }
   break;

/* Format 2 */
case 2:
   first_gid = 1;
   p = font->charset + 1;
   while (first_gid <= (unsigned)font->num_glyphs && p + 3 < font->data_end) {
first_cid = get_unaligned_be16 (p);
num_left = get_unaligned_be16 (p+2);
if (cid >= first_cid && cid <= first_cid + num_left) {
    *gid = first_gid + cid - first_cid;
    return CAIRO_STATUS_SUCCESS;
}
first_gid += num_left + 1;
p += 4;
   }
   break;

default:
   break;
  }
  return CAIRO_INT_STATUS_UNSUPPORTED;
1778}

1780static cairo_int_status_t
1781cairo_cff_font_subset_charstrings_and_subroutines (cairo_cff_font_t  *font)
1782{
  cff_index_element_t *element;
  unsigned int i;
  cairo_int_status_t status;
  unsigned long glyph, cid;

  font->subset_subroutines = TRUE1;
  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
if (font->is_cid && !font->is_opentype) {
   cid = font->scaled_font_subset->glyphs[i];
   status = cairo_cff_font_get_gid_for_cid (font, cid, &glyph);
   if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;
} else {
   glyph = font->scaled_font_subset->glyphs[i];
}
      element = _cairo_array_index (&font->charstrings_index, glyph);
      status = cff_index_append (&font->charstrings_subset_index,
                                 element->data,
                                 element->length);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;

if (font->subset_subroutines) {
   status = cairo_cff_find_width_and_subroutines_used (font,
						element->data, element->length,
						glyph, i);
   if (status == CAIRO_INT_STATUS_UNSUPPORTED) {
/* If parsing the charstrings fails we embed all the
 * subroutines. But if the font is not opentype we
 * need to successfully parse all charstrings to get
 * the widths. */
font->subset_subroutines = FALSE0;
if (!font->is_opentype)
    return status;
   } else if (unlikely (status)(__builtin_expect (!!(status), 0))) {
              return status;
   }
      }
  }

  return CAIRO_STATUS_SUCCESS;
1824}

1826static cairo_status_t
1827cairo_cff_font_subset_fontdict (cairo_cff_font_t  *font)
1828{
  unsigned int i;
  int fd;
  int *reverse_map;
  unsigned long cid, gid;
  cairo_int_status_t status;

  font->fdselect_subset = calloc (font->scaled_font_subset->num_glyphs,
                                   sizeof (int));
  if (unlikely (font->fdselect_subset == NULL)(__builtin_expect (!!(font->fdselect_subset == ((void*)0))
, 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  font->fd_subset_map = calloc (font->num_fontdicts, sizeof (int));
  if (unlikely (font->fd_subset_map == NULL)(__builtin_expect (!!(font->fd_subset_map == ((void*)0)), 0
)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  font->private_dict_offset = calloc (font->num_fontdicts, sizeof (int));
  if (unlikely (font->private_dict_offset == NULL)(__builtin_expect (!!(font->private_dict_offset == ((void*
)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  reverse_map = calloc (font->num_fontdicts, sizeof (int));
  if (unlikely (reverse_map == NULL)(__builtin_expect (!!(reverse_map == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  for (i = 0; i < font->num_fontdicts; i++)
      reverse_map[i] = -1;

  font->num_subset_fontdicts = 0;
  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
if (font->is_opentype) {
   gid = font->scaled_font_subset->glyphs[i];
} else {
   cid = font->scaled_font_subset->glyphs[i];
   status = cairo_cff_font_get_gid_for_cid (font, cid, &gid);
   if (unlikely (status)(__builtin_expect (!!(status), 0))) {
free (reverse_map);
return status;
   }
}

      fd = font->fdselect[gid];
      if (reverse_map[fd] < 0) {
          font->fd_subset_map[font->num_subset_fontdicts] = fd;
          reverse_map[fd] = font->num_subset_fontdicts++;
      }
      font->fdselect_subset[i] = reverse_map[fd];
  }

  free (reverse_map);

  return CAIRO_STATUS_SUCCESS;
1879}

1881static cairo_status_t
1882cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
1883{
  unsigned char buf[100];
  unsigned char *end_buf;
  cairo_status_t status;

  font->num_fontdicts = 1;
  font->fd_dict = _cairo_malloc (sizeof (cairo_hash_table_t *))((sizeof (cairo_hash_table_t *)) != 0 ? malloc(sizeof (cairo_hash_table_t
 *)) : ((void*)0));
  if (unlikely (font->fd_dict == NULL)(__builtin_expect (!!(font->fd_dict == ((void*)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  if (cff_dict_init (&font->fd_dict[0])) {
free (font->fd_dict);
font->fd_dict = NULL((void*)0);
font->num_fontdicts = 0;
return _cairo_error (CAIRO_STATUS_NO_MEMORY);
  }

  font->fd_subset_map = _cairo_malloc (sizeof (int))((sizeof (int)) != 0 ? malloc(sizeof (int)) : ((void*)0));
  if (unlikely (font->fd_subset_map == NULL)(__builtin_expect (!!(font->fd_subset_map == ((void*)0)), 0
)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  font->private_dict_offset = _cairo_malloc (sizeof (int))((sizeof (int)) != 0 ? malloc(sizeof (int)) : ((void*)0));
  if (unlikely (font->private_dict_offset == NULL)(__builtin_expect (!!(font->private_dict_offset == ((void*
)0)), 0)))
return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  font->fd_subset_map[0] = 0;
  font->num_subset_fontdicts = 1;

  /* Set integer operand to max value to use max size encoding to reserve
   * space for any value later */
  end_buf = encode_integer_max (buf, 0);
  end_buf = encode_integer_max (end_buf, 0);
  status = cff_dict_set_operands (font->fd_dict[0], PRIVATE_OP0x0012, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  return CAIRO_STATUS_SUCCESS;
1920}

1922static cairo_status_t
1923cairo_cff_font_subset_strings (cairo_cff_font_t *font)
1924{
  cairo_status_t status;
  unsigned int i;

  status = cairo_cff_font_subset_dict_strings (font, font->top_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (font->is_cid) {
      for (i = 0; i < font->num_subset_fontdicts; i++) {
          status = cairo_cff_font_subset_dict_strings (font, font->fd_dict[font->fd_subset_map[i]]);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;

          status = cairo_cff_font_subset_dict_strings (font, font->fd_private_dict[font->fd_subset_map[i]]);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
  } else {
      status = cairo_cff_font_subset_dict_strings (font, font->private_dict);
  }

  return status;
1947}

1949/* The Euro is the only the only character in the winansi encoding
* with a glyph name that is not a CFF standard string. As the strings
* are written before the charset, we need to check during the
* subsetting phase if the Euro glyph is required and add the
* glyphname to the list of strings to write out.
*/
1955static cairo_status_t
1956cairo_cff_font_add_euro_charset_string (cairo_cff_font_t *font)
1957{
  cairo_status_t status;
  unsigned int i;
  int ch;
  const char *euro = "Euro";

  for (i = 1; i < font->scaled_font_subset->num_glyphs; i++) {
ch = font->scaled_font_subset->to_latin_char[i];
if (ch == 128) {
   font->euro_sid = NUM_STD_STRINGS391 + _cairo_array_num_elements (&font->strings_subset_index);
   status = cff_index_append_copy (&font->strings_subset_index,
			    (unsigned char *)euro, strlen(euro));
   return status;
}
  }

  return CAIRO_STATUS_SUCCESS;
1974}

1976static cairo_status_t
1977cairo_cff_font_subset_font (cairo_cff_font_t  *font)
1978{
  cairo_status_t status;

  if (!font->scaled_font_subset->is_latin) {
status = cairo_cff_font_set_ros_strings (font);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }

  status = cairo_cff_font_subset_charstrings_and_subroutines (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (!font->scaled_font_subset->is_latin) {
if (font->is_cid)
   status = cairo_cff_font_subset_fontdict (font);
else
   status = cairo_cff_font_create_cid_fontdict (font);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }  else {
font->private_dict_offset = _cairo_malloc (sizeof (int))((sizeof (int)) != 0 ? malloc(sizeof (int)) : ((void*)0));
if (unlikely (font->private_dict_offset == NULL)(__builtin_expect (!!(font->private_dict_offset == ((void*
)0)), 0)))
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);
  }

  status = cairo_cff_font_subset_strings (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (font->scaled_font_subset->is_latin)
status = cairo_cff_font_add_euro_charset_string (font);

  return status;
2012}

2014/* Set the operand of the specified operator in the (already written)
* top dict to point to the current position in the output
* array. Operands updated with this function must have previously
* been encoded with the 5-byte (max) integer encoding. */
2018static void
2019cairo_cff_font_set_topdict_operator_to_cur_pos (cairo_cff_font_t  *font,
                                              int                operator)
2021{
  int cur_pos;
  int offset;
  int size;
  unsigned char buf[10];
  unsigned char *buf_end;
  unsigned char *op_ptr;

  cur_pos = _cairo_array_num_elements (&font->output);
  buf_end = encode_integer_max (buf, cur_pos);
  offset = cff_dict_get_location (font->top_dict, operator, &size);
  assert (offset > 0)((void) sizeof ((offset > 0) ? 1 : 0), __extension__ ({ if
 (offset > 0) ; else __assert_fail ("offset > 0", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2032, __extension__ __PRETTY_FUNCTION__); }));
  op_ptr = _cairo_array_index (&font->output, offset);
  memcpy (op_ptr, buf, buf_end - buf);
2035}

2037static cairo_status_t
2038cairo_cff_font_write_header (cairo_cff_font_t *font)
2039{
  return _cairo_array_append_multiple (&font->output,
                                       font->header,
                                       font->header->header_size);
2043}

2045static cairo_status_t
2046cairo_cff_font_write_name (cairo_cff_font_t *font)
2047{
  cairo_status_t status = CAIRO_STATUS_SUCCESS;
  cairo_array_t index;

  cff_index_init (&index);

  status = cff_index_append_copy (&index,
                                  (unsigned char *) font->ps_name,
                                  strlen(font->ps_name));
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto FAIL;

  status = cff_index_write (&index, &font->output);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto FAIL;

2063FAIL:
  cff_index_fini (&index);

  return status;
2067}

2069static cairo_status_t
2070cairo_cff_font_write_top_dict (cairo_cff_font_t *font)
2071{
  uint16_t count;
  unsigned char buf[10];
  unsigned char *p;
  int offset_index;
  int dict_start, dict_size;
  int offset_size = 4;
  cairo_status_t status;

  /* Write an index containing the top dict */

  count = cpu_to_be16 (1);
  status = _cairo_array_append_multiple (&font->output, &count, 2);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  buf[0] = offset_size;
  status = _cairo_array_append (&font->output, buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  encode_index_offset (buf, offset_size, 1);
  status = _cairo_array_append_multiple (&font->output, buf, offset_size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  /* Reserve space for last element of offset array and update after
   * dict is written */
  offset_index = _cairo_array_num_elements (&font->output);
  status = _cairo_array_append_multiple (&font->output, buf, offset_size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  dict_start = _cairo_array_num_elements (&font->output);
  status = cff_dict_write (font->top_dict, &font->output);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  dict_size = _cairo_array_num_elements (&font->output) - dict_start;

  encode_index_offset (buf, offset_size, dict_size + 1);
  p = _cairo_array_index (&font->output, offset_index);
  memcpy (p, buf, offset_size);

  return CAIRO_STATUS_SUCCESS;
2113}

2115static cairo_status_t
2116cairo_cff_font_write_strings (cairo_cff_font_t  *font)
2117{
  return cff_index_write (&font->strings_subset_index, &font->output);
2119}

2121static cairo_status_t
2122cairo_cff_font_write_global_subrs (cairo_cff_font_t  *font)
2123{
  unsigned int i;
  unsigned char return_op = TYPE2_return0x000b;

  /* poppler and fontforge don't like zero length subroutines so we
   * replace unused subroutines with a 'return' instruction. */
  if (font->subset_subroutines) {
      for (i = 0; i < _cairo_array_num_elements (&font->global_sub_index); i++) {
          if (! font->global_subs_used[i])
              cff_index_set_object (&font->global_sub_index, i, &return_op, 1);
      }
  }

  return cff_index_write (&font->global_sub_index, &font->output);
2137}

2139static cairo_status_t
2140cairo_cff_font_write_encoding (cairo_cff_font_t  *font)
2141{
  unsigned char buf[2];
  cairo_status_t status;
  unsigned int i;

  cairo_cff_font_set_topdict_operator_to_cur_pos (font, ENCODING_OP0x0010);
  buf[0] = 0; /* Format 0 */
  buf[1] = font->scaled_font_subset->num_glyphs - 1;
  status = _cairo_array_append_multiple (&font->output, buf, 2);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  for (i = 1; i < font->scaled_font_subset->num_glyphs; i++) {
unsigned char ch = font->scaled_font_subset->to_latin_char[i];
      status = _cairo_array_append (&font->output, &ch);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  return CAIRO_STATUS_SUCCESS;
2161}

2163static cairo_status_t
2164cairo_cff_font_write_fdselect (cairo_cff_font_t  *font)
2165{
  unsigned char data;
  unsigned int i;
  cairo_int_status_t status;

  cairo_cff_font_set_topdict_operator_to_cur_pos (font, FDSELECT_OP0x0c25);

  if (font->is_cid) {
      data = 0;
      status = _cairo_array_append (&font->output, &data);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;

      for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
          data = font->fdselect_subset[i];
          status = _cairo_array_append (&font->output, &data);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
  } else {
      unsigned char byte;
      uint16_t word;

      status = _cairo_array_grow_by (&font->output, 9);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;

      byte = 3;
      status = _cairo_array_append (&font->output, &byte);
      assert (status == CAIRO_INT_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_INT_STATUS_SUCCESS) ? 1 : 0)
, __extension__ ({ if (status == CAIRO_INT_STATUS_SUCCESS) ; else
 __assert_fail ("status == CAIRO_INT_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2194, __extension__ __PRETTY_FUNCTION__); }));

      word = cpu_to_be16 (1);
      status = _cairo_array_append_multiple (&font->output, &word, 2);
      assert (status == CAIRO_INT_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_INT_STATUS_SUCCESS) ? 1 : 0)
, __extension__ ({ if (status == CAIRO_INT_STATUS_SUCCESS) ; else
 __assert_fail ("status == CAIRO_INT_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2198, __extension__ __PRETTY_FUNCTION__); }));

      word = cpu_to_be16 (0);
      status = _cairo_array_append_multiple (&font->output, &word, 2);
      assert (status == CAIRO_INT_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_INT_STATUS_SUCCESS) ? 1 : 0)
, __extension__ ({ if (status == CAIRO_INT_STATUS_SUCCESS) ; else
 __assert_fail ("status == CAIRO_INT_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2202, __extension__ __PRETTY_FUNCTION__); }));

      byte = 0;
      status = _cairo_array_append (&font->output, &byte);
      assert (status == CAIRO_INT_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_INT_STATUS_SUCCESS) ? 1 : 0)
, __extension__ ({ if (status == CAIRO_INT_STATUS_SUCCESS) ; else
 __assert_fail ("status == CAIRO_INT_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2206, __extension__ __PRETTY_FUNCTION__); }));

      word = cpu_to_be16 (font->scaled_font_subset->num_glyphs);
      status = _cairo_array_append_multiple (&font->output, &word, 2);
      assert (status == CAIRO_INT_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_INT_STATUS_SUCCESS) ? 1 : 0)
, __extension__ ({ if (status == CAIRO_INT_STATUS_SUCCESS) ; else
 __assert_fail ("status == CAIRO_INT_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2210, __extension__ __PRETTY_FUNCTION__); }));
  }

  return CAIRO_STATUS_SUCCESS;
2214}

2216/* Winansi to CFF standard strings mapping for characters 128 to 255 */
2217static const int winansi_to_cff_std_string[] = {
/* 128 */
    0,   0, 117, 101, 118, 121, 112, 113,
  126, 122, 192, 107, 142,   0, 199,   0,
/* 144 */
    0,  65,   8, 105, 119, 116, 111, 137,
  127, 153, 221, 108, 148,   0, 228, 198,
/* 160 */
    0,  96,  97,  98, 103, 100, 160, 102,
  131, 170, 139, 106, 151,   0, 165, 128,
/* 176 */
  161, 156, 164, 169, 125, 152, 115, 114,
  133, 150, 143, 120, 158, 155, 163, 123,
/* 192 */
  174, 171, 172, 176, 173, 175, 138, 177,
  181, 178, 179, 180, 185, 182, 183, 184,
/* 208 */
  154, 186, 190, 187, 188, 191, 189, 168,
  141, 196, 193, 194, 195, 197, 157, 149,
/* 224 */
  203, 200, 201, 205, 202, 204, 144, 206,
  210, 207, 208, 209, 214, 211, 212, 213,
/* 240 */
  167, 215, 219, 216, 217, 220, 218, 159,
  147, 225, 222, 223, 224, 226, 162, 227,
2242};

2244static int
2245cairo_cff_font_get_sid_for_winansi_char (cairo_cff_font_t  *font, int ch)
2246{
  int sid;

  if (ch == 39) {
sid = 104;

  } else if (ch == 96) {
sid = 124;

  } else if (ch >= 32 && ch <= 126) {
sid = ch - 31;

  } else if (ch == 128) {
assert (font->euro_sid >= NUM_STD_STRINGS)((void) sizeof ((font->euro_sid >= 391) ? 1 : 0), __extension__
 ({ if (font->euro_sid >= 391) ; else __assert_fail ("font->euro_sid >= NUM_STD_STRINGS"
, "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2259, __extension__ __PRETTY_FUNCTION__); }));
sid = font->euro_sid;

  } else if (ch >= 128 && ch <= 255) {
sid = winansi_to_cff_std_string[ch - 128];

  } else {
sid = 0;
  }

  return sid;
2270}

2272static cairo_status_t
2273cairo_cff_font_write_type1_charset (cairo_cff_font_t  *font)
2274{
  unsigned char format = 0;
  unsigned int i;
  int ch, sid;
  cairo_status_t status;
  uint16_t sid_be16;

  cairo_cff_font_set_topdict_operator_to_cur_pos (font, CHARSET_OP0x000f);
  status = _cairo_array_append (&font->output, &format);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  for (i = 1; i < font->scaled_font_subset->num_glyphs; i++) {
ch = font->scaled_font_subset->to_latin_char[i];
sid = cairo_cff_font_get_sid_for_winansi_char (font, ch);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

sid_be16 = cpu_to_be16(sid);
status = _cairo_array_append_multiple (&font->output, &sid_be16, sizeof(sid_be16));
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  return CAIRO_STATUS_SUCCESS;
2299}

2301static cairo_status_t
2302cairo_cff_font_write_cid_charset (cairo_cff_font_t  *font)
2303{
  unsigned char byte;
  uint16_t word;
  cairo_status_t status;

  cairo_cff_font_set_topdict_operator_to_cur_pos (font, CHARSET_OP0x000f);
  status = _cairo_array_grow_by (&font->output, 5);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  byte = 2;
  status = _cairo_array_append (&font->output, &byte);
  assert (status == CAIRO_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_STATUS_SUCCESS) ? 1 : 0), __extension__
 ({ if (status == CAIRO_STATUS_SUCCESS) ; else __assert_fail (
"status == CAIRO_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2315, __extension__ __PRETTY_FUNCTION__); }));

  word = cpu_to_be16 (1);
  status = _cairo_array_append_multiple (&font->output, &word, 2);
  assert (status == CAIRO_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_STATUS_SUCCESS) ? 1 : 0), __extension__
 ({ if (status == CAIRO_STATUS_SUCCESS) ; else __assert_fail (
"status == CAIRO_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2319, __extension__ __PRETTY_FUNCTION__); }));

  word = cpu_to_be16 (font->scaled_font_subset->num_glyphs - 2);
  status = _cairo_array_append_multiple (&font->output, &word, 2);
  assert (status == CAIRO_STATUS_SUCCESS)((void) sizeof ((status == CAIRO_STATUS_SUCCESS) ? 1 : 0), __extension__
 ({ if (status == CAIRO_STATUS_SUCCESS) ; else __assert_fail (
"status == CAIRO_STATUS_SUCCESS", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2323, __extension__ __PRETTY_FUNCTION__); }));

  return CAIRO_STATUS_SUCCESS;
2326}

2328static cairo_status_t
2329cairo_cff_font_write_charstrings (cairo_cff_font_t  *font)
2330{
  cairo_cff_font_set_topdict_operator_to_cur_pos (font, CHARSTRINGS_OP0x0011);

  return cff_index_write (&font->charstrings_subset_index, &font->output);
2334}

2336static cairo_status_t
2337cairo_cff_font_write_cid_fontdict (cairo_cff_font_t *font)
2338{
  unsigned int i;
  cairo_int_status_t status;
  unsigned int offset_array;
  unsigned char *offset_array_ptr;
  int offset_base;
  uint16_t count;
  uint8_t offset_size = 4;

  cairo_cff_font_set_topdict_operator_to_cur_pos (font, FDARRAY_OP0x0c24);
  count = cpu_to_be16 (font->num_subset_fontdicts);
  status = _cairo_array_append_multiple (&font->output, &count, sizeof (uint16_t));
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  status = _cairo_array_append (&font->output, &offset_size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  offset_array = _cairo_array_num_elements (&font->output);
  status = _cairo_array_allocate (&font->output,
                                  (font->num_subset_fontdicts + 1)*offset_size,
                                  (void **) &offset_array_ptr);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  offset_base = _cairo_array_num_elements (&font->output) - 1;
  put_unaligned_be32(1, offset_array_ptr);
  offset_array += sizeof(uint32_t);
  for (i = 0; i < font->num_subset_fontdicts; i++) {
      status = cff_dict_write (font->fd_dict[font->fd_subset_map[i]],
                               &font->output);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;

offset_array_ptr = _cairo_array_index (&font->output, offset_array);
put_unaligned_be32 (_cairo_array_num_elements (&font->output) - offset_base,
	    offset_array_ptr);
offset_array += sizeof(uint32_t);
  }

  return CAIRO_STATUS_SUCCESS;
2378}

2380static cairo_status_t
2381cairo_cff_font_write_private_dict (cairo_cff_font_t   *font,
		   int                 dict_num,
		   cairo_hash_table_t *parent_dict,
		   cairo_hash_table_t *private_dict)
2385{
  int offset;
  int size;
  unsigned char buf[10];
  unsigned char *buf_end;
  unsigned char *p;
  cairo_status_t status;

  /* Write private dict and update offset and size in top dict */
  font->private_dict_offset[dict_num] = _cairo_array_num_elements (&font->output);
  status = cff_dict_write (private_dict, &font->output);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  size = _cairo_array_num_elements (&font->output) - font->private_dict_offset[dict_num];
  /* private entry has two operands - size and offset */
  buf_end = encode_integer_max (buf, size);
  buf_end = encode_integer_max (buf_end, font->private_dict_offset[dict_num]);
  offset = cff_dict_get_location (parent_dict, PRIVATE_OP0x0012, &size);
  assert (offset > 0)((void) sizeof ((offset > 0) ? 1 : 0), __extension__ ({ if
 (offset > 0) ; else __assert_fail ("offset > 0", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2404, __extension__ __PRETTY_FUNCTION__); }));
  p = _cairo_array_index (&font->output, offset);
  memcpy (p, buf, buf_end - buf);

  return CAIRO_STATUS_SUCCESS;
2409}

2411static cairo_status_t
2412cairo_cff_font_write_local_sub (cairo_cff_font_t   *font,
                              int                 dict_num,
                              cairo_hash_table_t *private_dict,
                              cairo_array_t      *local_sub_index,
                              cairo_bool_t       *local_subs_used)
2417{
  int offset;
  int size;
  unsigned char buf[10];
  unsigned char *buf_end;
  unsigned char *p;
  cairo_status_t status;
  unsigned int i;
  unsigned char return_op = TYPE2_return0x000b;

  if (_cairo_array_num_elements (local_sub_index) > 0) {
      /* Write local subroutines and update offset in private
       * dict. Local subroutines offset is relative to start of
       * private dict */
      offset = _cairo_array_num_elements (&font->output) - font->private_dict_offset[dict_num];
      buf_end = encode_integer_max (buf, offset);
      offset = cff_dict_get_location (private_dict, LOCAL_SUB_OP0x0013, &size);
      assert (offset > 0)((void) sizeof ((offset > 0) ? 1 : 0), __extension__ ({ if
 (offset > 0) ; else __assert_fail ("offset > 0", "/root/firefox-clang/gfx/cairo/cairo/src/cairo-cff-subset.c"
, 2434, __extension__ __PRETTY_FUNCTION__); }));
      p = _cairo_array_index (&font->output, offset);
      memcpy (p, buf, buf_end - buf);

/* poppler and fontforge don't like zero length subroutines so
* we replace unused subroutines with a 'return' instruction.
*/
      if (font->subset_subroutines) {
          for (i = 0; i < _cairo_array_num_elements (local_sub_index); i++) {
              if (! local_subs_used[i])
                  cff_index_set_object (local_sub_index, i, &return_op, 1);
          }
      }
      status = cff_index_write (local_sub_index, &font->output);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  return CAIRO_STATUS_SUCCESS;
2453}


2456static cairo_status_t
2457cairo_cff_font_write_cid_private_dict_and_local_sub (cairo_cff_font_t  *font)
2458{
  unsigned int i;
  cairo_int_status_t status;

  if (font->is_cid) {
      for (i = 0; i < font->num_subset_fontdicts; i++) {
          status = cairo_cff_font_write_private_dict (
                          font,
                          i,
                          font->fd_dict[font->fd_subset_map[i]],
                          font->fd_private_dict[font->fd_subset_map[i]]);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }

      for (i = 0; i < font->num_subset_fontdicts; i++) {
          status = cairo_cff_font_write_local_sub (
                          font,
                          i,
                          font->fd_private_dict[font->fd_subset_map[i]],
                          &font->fd_local_sub_index[font->fd_subset_map[i]],
                          font->fd_local_subs_used[font->fd_subset_map[i]]);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
  } else {
      status = cairo_cff_font_write_private_dict (font,
                                                  0,
                                                  font->fd_dict[0],
                                                  font->private_dict);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

      status = cairo_cff_font_write_local_sub (font,
                                               0,
                                               font->private_dict,
                                               &font->local_sub_index,
                                               font->local_subs_used);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }

  return CAIRO_STATUS_SUCCESS;
2501}

2503static cairo_status_t
2504cairo_cff_font_write_type1_private_dict_and_local_sub (cairo_cff_font_t  *font)
2505{
  cairo_int_status_t status;

  status = cairo_cff_font_write_private_dict (font,
				0,
				font->top_dict,
				font->private_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  status = cairo_cff_font_write_local_sub (font,
			     0,
			     font->private_dict,
			     &font->local_sub_index,
			     font->local_subs_used);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  return CAIRO_STATUS_SUCCESS;
2524}


2527typedef cairo_status_t
2528(*font_write_t) (cairo_cff_font_t *font);

2530static const font_write_t font_write_cid_funcs[] = {
  cairo_cff_font_write_header,
  cairo_cff_font_write_name,
  cairo_cff_font_write_top_dict,
  cairo_cff_font_write_strings,
  cairo_cff_font_write_global_subrs,
  cairo_cff_font_write_cid_charset,
  cairo_cff_font_write_fdselect,
  cairo_cff_font_write_charstrings,
  cairo_cff_font_write_cid_fontdict,
  cairo_cff_font_write_cid_private_dict_and_local_sub,
2541};

2543static const font_write_t font_write_type1_funcs[] = {
  cairo_cff_font_write_header,
  cairo_cff_font_write_name,
  cairo_cff_font_write_top_dict,
  cairo_cff_font_write_strings,
  cairo_cff_font_write_global_subrs,
  cairo_cff_font_write_encoding,
  cairo_cff_font_write_type1_charset,
  cairo_cff_font_write_charstrings,
  cairo_cff_font_write_type1_private_dict_and_local_sub,
2553};

2555static cairo_status_t
2556cairo_cff_font_write_subset (cairo_cff_font_t *font)
2557{
  cairo_int_status_t status;
  unsigned int i;

  if (font->scaled_font_subset->is_latin) {
      for (i = 0; i < ARRAY_LENGTH (font_write_type1_funcs)((int) (sizeof (font_write_type1_funcs) / sizeof (font_write_type1_funcs
[0]))); i++) {
          status = font_write_type1_funcs[i] (font);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
  } else {
      for (i = 0; i < ARRAY_LENGTH (font_write_cid_funcs)((int) (sizeof (font_write_cid_funcs) / sizeof (font_write_cid_funcs
[0]))); i++) {
          status = font_write_cid_funcs[i] (font);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
  }

  return CAIRO_STATUS_SUCCESS;
2576}

2578static cairo_int_status_t
2579cairo_cff_font_generate (cairo_cff_font_t  *font,
                       const char       **data,
                       unsigned long     *length)
2582{
  cairo_int_status_t status;

  status = cairo_cff_font_read_font (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  /* If the PS name is not found, create a CairoFont-x-y name. */
  if (font->ps_name == NULL((void*)0)) {
      font->ps_name = _cairo_malloc (30)((30) != 0 ? malloc(30) : ((void*)0));
      if (unlikely (font->ps_name == NULL)(__builtin_expect (!!(font->ps_name == ((void*)0)), 0)))
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);

      snprintf(font->ps_name, 30, "CairoFont-%u-%u",
               font->scaled_font_subset->font_id,
               font->scaled_font_subset->subset_id);
  }

  status = cairo_cff_font_subset_font (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  status = cairo_cff_font_write_subset (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;


  *data = _cairo_array_index (&font->output, 0);
  *length = _cairo_array_num_elements (&font->output);

  return CAIRO_STATUS_SUCCESS;
2613}

2615static cairo_int_status_t
2616cairo_cff_font_create_set_widths (cairo_cff_font_t *font)
2617{
  unsigned long size;
  unsigned long long_entry_size;
  unsigned long short_entry_size;
  unsigned int i;
  tt_hhea_t hhea;
  int num_hmetrics;
  uint16_t short_entry;
  int glyph_index;
  cairo_int_status_t status;

  size = sizeof (tt_hhea_t);
  status = font->backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                               TT_TAG_hhea((int)((uint32_t)'h'<<24 | 'h'<<16 | 'e'<<8
 | 'a')), 0,
                                               (unsigned char*) &hhea, &size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;
  num_hmetrics = be16_to_cpu (hhea.num_hmetrics);

  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
      glyph_index = font->scaled_font_subset->glyphs[i];
      long_entry_size = 2 * sizeof (int16_t);
      short_entry_size = sizeof (int16_t);
      if (glyph_index < num_hmetrics) {
          status = font->backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                                       TT_TAG_hmtx((int)((uint32_t)'h'<<24 | 'm'<<16 | 't'<<8
 | 'x')),
                                                       glyph_index * long_entry_size,
                                                       (unsigned char *) &short_entry,
					 &short_entry_size);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
      else
      {
          status = font->backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                                       TT_TAG_hmtx((int)((uint32_t)'h'<<24 | 'm'<<16 | 't'<<8
 | 'x')),
                                                       (num_hmetrics - 1) * long_entry_size,
                                                       (unsigned char *) &short_entry,
					 &short_entry_size);
          if (unlikely (status)(__builtin_expect (!!(status), 0)))
              return status;
      }
font->widths[i] = be16_to_cpu (short_entry);
  }

  return CAIRO_STATUS_SUCCESS;
2663}

2665static cairo_bool_t
2666check_fontdata_is_cff (const unsigned char *data, long length)
2667{
  cff_header_t *header;

  if (length < (long)sizeof (cff_header_t))
      return FALSE0;

  header = (cff_header_t *) data;
  if (header->major == 1 &&
header->minor == 0 &&
header->header_size == 4)
  {
return TRUE1;
  }

  return FALSE0;
2682}

2684static cairo_int_status_t
2685_cairo_cff_font_load_opentype_cff (cairo_cff_font_t  *font)
2686{
  const cairo_scaled_font_backend_t *backend = font->backend;
  cairo_status_t status;
  tt_head_t head;
  tt_hhea_t hhea;
  unsigned long size, data_length;

  if (!backend->load_truetype_table)
return CAIRO_INT_STATUS_UNSUPPORTED;

  data_length = 0;
  status = backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                         TT_TAG_CFF((int)((uint32_t)'C'<<24 | 'F'<<16 | 'F'<<8
 | ' ')), 0, NULL((void*)0), &data_length);
  if (status)
      return status;

  size = sizeof (tt_head_t);
  status = backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                         TT_TAG_head((int)((uint32_t)'h'<<24 | 'e'<<16 | 'a'<<8
 | 'd')), 0,
                                         (unsigned char *) &head, &size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  size = sizeof (tt_hhea_t);
  status = backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                         TT_TAG_hhea((int)((uint32_t)'h'<<24 | 'h'<<16 | 'e'<<8
 | 'a')), 0,
                                         (unsigned char *) &hhea, &size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  size = 0;
  status = backend->load_truetype_table (font->scaled_font_subset->scaled_font,
                                         TT_TAG_hmtx((int)((uint32_t)'h'<<24 | 'm'<<16 | 't'<<8
 | 'x')), 0, NULL((void*)0), &size);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  font->x_min = (int16_t) be16_to_cpu (head.x_min);
  font->y_min = (int16_t) be16_to_cpu (head.y_min);
  font->x_max = (int16_t) be16_to_cpu (head.x_max);
  font->y_max = (int16_t) be16_to_cpu (head.y_max);
  font->ascent = (int16_t) be16_to_cpu (hhea.ascender);
  font->descent = (int16_t) be16_to_cpu (hhea.descender);
  font->units_per_em = (int16_t) be16_to_cpu (head.units_per_em);
  if (font->units_per_em == 0)
      font->units_per_em = 1000;

  font->font_name = NULL((void*)0);
  status = _cairo_truetype_read_font_name (font->scaled_font_subset->scaled_font,
			     &font->ps_name,
			     &font->font_name);
  if (_cairo_status_is_error (status)((status) != CAIRO_STATUS_SUCCESS && (status) < CAIRO_STATUS_LAST_STATUS
))
return status;

  font->is_opentype = TRUE1;
  font->data_length = data_length;
  font->data = _cairo_malloc (data_length)((data_length) != 0 ? malloc(data_length) : ((void*)0));
  if (unlikely (font->data == NULL)(__builtin_expect (!!(font->data == ((void*)0)), 0)))
      return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  status = font->backend->load_truetype_table (font->scaled_font_subset->scaled_font,
				 TT_TAG_CFF((int)((uint32_t)'C'<<24 | 'F'<<16 | 'F'<<8
 | ' ')), 0, font->data,
				 &font->data_length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (!check_fontdata_is_cff (font->data, data_length))
return CAIRO_INT_STATUS_UNSUPPORTED;

  return CAIRO_STATUS_SUCCESS;
2755}

2757static cairo_int_status_t
2758_cairo_cff_font_load_cff (cairo_cff_font_t  *font)
2759{
  const cairo_scaled_font_backend_t *backend = font->backend;
  cairo_status_t status;
  unsigned long data_length;

  if (!backend->load_type1_data)
return CAIRO_INT_STATUS_UNSUPPORTED;

  data_length = 0;
  status = backend->load_type1_data (font->scaled_font_subset->scaled_font,
		      0, NULL((void*)0), &data_length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  font->font_name = NULL((void*)0);
  font->is_opentype = FALSE0;
  font->data_length = data_length;
  font->data = _cairo_malloc (data_length)((data_length) != 0 ? malloc(data_length) : ((void*)0));
  if (unlikely (font->data == NULL)(__builtin_expect (!!(font->data == ((void*)0)), 0)))
      return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  status = font->backend->load_type1_data (font->scaled_font_subset->scaled_font,
			     0, font->data, &font->data_length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  if (!check_fontdata_is_cff (font->data, data_length))
return CAIRO_INT_STATUS_UNSUPPORTED;

  return CAIRO_STATUS_SUCCESS;
2789}

2791static cairo_int_status_t
2792_cairo_cff_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
                      cairo_cff_font_t           **font_return,
                      const char                  *subset_name)
2795{
  const cairo_scaled_font_backend_t *backend;
  cairo_int_status_t status;
  cairo_bool_t is_synthetic;
  cairo_cff_font_t *font;

  backend = scaled_font_subset->scaled_font->backend;

  /* We need to use a fallback font if this font differs from the CFF outlines. */
  if (backend->is_synthetic) {
status = backend->is_synthetic (scaled_font_subset->scaled_font, &is_synthetic);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

if (is_synthetic)
   return CAIRO_INT_STATUS_UNSUPPORTED;
  }

  font = calloc (1, sizeof (cairo_cff_font_t));
  if (unlikely (font == NULL)(__builtin_expect (!!(font == ((void*)0)), 0)))
      return _cairo_error (CAIRO_STATUS_NO_MEMORY);

  font->backend = backend;
  font->scaled_font_subset = scaled_font_subset;

  status = _cairo_cff_font_load_opentype_cff (font);
  if (status == CAIRO_INT_STATUS_UNSUPPORTED)
status = _cairo_cff_font_load_cff (font);
  if (status)
goto fail1;

  font->data_end = font->data + font->data_length;
  _cairo_array_init (&font->output, sizeof (char));
  status = _cairo_array_grow_by (&font->output, 4096);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail2;

  font->subset_font_name = strdup (subset_name);
  if (unlikely (font->subset_font_name == NULL)(__builtin_expect (!!(font->subset_font_name == ((void*)0)
), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail2;
  }

  font->widths = calloc (font->scaled_font_subset->num_glyphs, sizeof (int));
  if (unlikely (font->widths == NULL)(__builtin_expect (!!(font->widths == ((void*)0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail3;
  }

  if (font->is_opentype) {
status = cairo_cff_font_create_set_widths (font);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail4;
  }

  status = cff_dict_init (&font->top_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail4;

  status = cff_dict_init (&font->private_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail5;

  cff_index_init (&font->strings_index);
  cff_index_init (&font->charstrings_index);
  cff_index_init (&font->global_sub_index);
  cff_index_init (&font->local_sub_index);
  cff_index_init (&font->charstrings_subset_index);
  cff_index_init (&font->strings_subset_index);
  font->euro_sid = 0;
  font->fdselect = NULL((void*)0);
  font->fd_dict = NULL((void*)0);
  font->fd_private_dict = NULL((void*)0);
  font->fd_local_sub_index = NULL((void*)0);
  font->fd_local_sub_bias = NULL((void*)0);
  font->fdselect_subset = NULL((void*)0);
  font->fd_subset_map = NULL((void*)0);
  font->private_dict_offset = NULL((void*)0);
  font->global_subs_used = NULL((void*)0);
  font->local_subs_used = NULL((void*)0);
  font->fd_local_subs_used = NULL((void*)0);

  *font_return = font;

  return CAIRO_STATUS_SUCCESS;

2881fail5:
  _cairo_hash_table_destroy (font->top_dict);
2883fail4:
  free (font->widths);
2885fail3:
  free (font->subset_font_name);
2887fail2:
  free (font->ps_name);
  _cairo_array_fini (&font->output);
2890fail1:
  free (font->data);
  free (font->font_name);
  free (font);

  return status;
2896}

2898static void
2899cairo_cff_font_destroy (cairo_cff_font_t *font)
2900{
  unsigned int i;

  free (font->widths);
  free (font->font_name);
  free (font->ps_name);
  free (font->subset_font_name);
  _cairo_array_fini (&font->output);
  cff_dict_fini (font->top_dict);
  cff_dict_fini (font->private_dict);
  cff_index_fini (&font->strings_index);
  cff_index_fini (&font->charstrings_index);
  cff_index_fini (&font->global_sub_index);
  cff_index_fini (&font->local_sub_index);
  cff_index_fini (&font->charstrings_subset_index);
  cff_index_fini (&font->strings_subset_index);

  /* If we bailed out early as a result of an error some of the
   * following cairo_cff_font_t members may still be NULL */
  if (font->fd_dict) {
      for (i = 0; i < font->num_fontdicts; i++) {
          if (font->fd_dict[i])
              cff_dict_fini (font->fd_dict[i]);
      }
      free (font->fd_dict);
  }
  free (font->global_subs_used);
  free (font->local_subs_used);
  free (font->fd_subset_map);
  free (font->private_dict_offset);

  if (font->is_cid) {
free (font->fdselect);
free (font->fdselect_subset);
      if (font->fd_private_dict) {
          for (i = 0; i < font->num_fontdicts; i++) {
              if (font->fd_private_dict[i])
                  cff_dict_fini (font->fd_private_dict[i]);
          }
          free (font->fd_private_dict);
      }
      if (font->fd_local_sub_index) {
          for (i = 0; i < font->num_fontdicts; i++)
              cff_index_fini (&font->fd_local_sub_index[i]);
          free (font->fd_local_sub_index);
      }
free (font->fd_local_sub_bias);
      if (font->fd_local_subs_used) {
          for (i = 0; i < font->num_fontdicts; i++) {
free (font->fd_local_subs_used[i]);
          }
          free (font->fd_local_subs_used);
      }
free (font->fd_default_width);
free (font->fd_nominal_width);
  }

  free (font->data);

  free (font);
2960}

2962cairo_status_t
2963_cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
                      const char		    *subset_name,
                      cairo_scaled_font_subset_t  *font_subset)
2966{
  cairo_cff_font_t *font = NULL((void*)0); /* squelch bogus compiler warning */
  cairo_status_t status;
  const char *data = NULL((void*)0); /* squelch bogus compiler warning */
  unsigned long length = 0; /* squelch bogus compiler warning */
  unsigned int i;

  status = _cairo_cff_font_create (font_subset, &font, subset_name);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  status = cairo_cff_font_generate (font, &data, &length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail1;

  cff_subset->ps_name = strdup (font->ps_name);
  if (unlikely (cff_subset->ps_name == NULL)(__builtin_expect (!!(cff_subset->ps_name == ((void*)0)), 0
))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail1;
  }

  if (font->font_name) {
cff_subset->family_name_utf8 = strdup (font->font_name);
if (cff_subset->family_name_utf8 == NULL((void*)0)) {
   status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
   goto fail2;
}
  } else {
cff_subset->family_name_utf8 = NULL((void*)0);
  }

  cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
  if (unlikely (cff_subset->widths == NULL)(__builtin_expect (!!(cff_subset->widths == ((void*)0)), 0
))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail3;
  }
  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
      cff_subset->widths[i] = (double)font->widths[i]/font->units_per_em;

  cff_subset->x_min = (double)font->x_min/font->units_per_em;
  cff_subset->y_min = (double)font->y_min/font->units_per_em;
  cff_subset->x_max = (double)font->x_max/font->units_per_em;
  cff_subset->y_max = (double)font->y_max/font->units_per_em;
  cff_subset->ascent = (double)font->ascent/font->units_per_em;
  cff_subset->descent = (double)font->descent/font->units_per_em;

  cff_subset->data = _cairo_malloc (length)((length) != 0 ? malloc(length) : ((void*)0));
  if (unlikely (cff_subset->data == NULL)(__builtin_expect (!!(cff_subset->data == ((void*)0)), 0))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail4;
  }

  memcpy (cff_subset->data, data, length);
  cff_subset->data_length = length;

  cairo_cff_font_destroy (font);

  return CAIRO_STATUS_SUCCESS;

fail4:
  free (cff_subset->widths);
fail3:
  free (cff_subset->family_name_utf8);
fail2:
  free (cff_subset->ps_name);
fail1:
  cairo_cff_font_destroy (font);

  return status;
3035}

3037void
3038_cairo_cff_subset_fini (cairo_cff_subset_t *subset)
3039{
  free (subset->ps_name);
  free (subset->family_name_utf8);
  free (subset->widths);
  free (subset->data);
3044}

3046cairo_bool_t
3047_cairo_cff_scaled_font_is_cid_cff (cairo_scaled_font_t *scaled_font)
3048{
  const cairo_scaled_font_backend_t *backend;
  cairo_int_status_t status;
  unsigned char *data;
  unsigned long data_length;
  unsigned char *current_ptr;
  unsigned char *data_end;
  cff_header_t  *header;
  cff_index_element_t *element;
  cairo_hash_table_t  *top_dict;
  cairo_array_t index;
  int size;
  cairo_bool_t is_cid = FALSE0;

  backend = scaled_font->backend;
  data = NULL((void*)0);
  data_length = 0;
  status = CAIRO_INT_STATUS_UNSUPPORTED;
  /* Try to load an OpenType/CFF font */
  if (backend->load_truetype_table &&
(status = backend->load_truetype_table (scaled_font, TT_TAG_CFF((int)((uint32_t)'C'<<24 | 'F'<<16 | 'F'<<8
 | ' ')),
				0, NULL((void*)0), &data_length)) == CAIRO_INT_STATUS_SUCCESS)
  {
data = _cairo_malloc (data_length)((data_length) != 0 ? malloc(data_length) : ((void*)0));
if (unlikely (data == NULL)(__builtin_expect (!!(data == ((void*)0)), 0))) {
   status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
   return FALSE0;
}

status = backend->load_truetype_table (scaled_font, TT_TAG_CFF((int)((uint32_t)'C'<<24 | 'F'<<16 | 'F'<<8
 | ' ')),
			   0, data, &data_length);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail1;
  }
  /* Try to load a CFF font */
  if (status == CAIRO_INT_STATUS_UNSUPPORTED &&
backend->load_type1_data &&
(status = backend->load_type1_data (scaled_font,
			    0, NULL((void*)0), &data_length)) == CAIRO_INT_STATUS_SUCCESS)
  {
data = _cairo_malloc (data_length)((data_length) != 0 ? malloc(data_length) : ((void*)0));
if (unlikely (data == NULL)(__builtin_expect (!!(data == ((void*)0)), 0))) {
   status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
   return FALSE0;
}

status = backend->load_type1_data (scaled_font, 0, data, &data_length);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   goto fail1;
  }
  if (status)
goto fail1;

  /* Check if it looks like a CFF font */
  if (!check_fontdata_is_cff (data, data_length))
goto fail1;

  data_end = data + data_length;

  /* skip header */
  if (data_length < sizeof (cff_header_t))
      goto fail1;

  header = (cff_header_t *) data;
  current_ptr = data + header->header_size;

  /* skip name */
  cff_index_init (&index);
  status = cff_index_read (&index, &current_ptr, data_end);
  cff_index_fini (&index);

  if (status)
      goto fail1;

  /* read top dict */
  cff_index_init (&index);
  status = cff_index_read (&index, &current_ptr, data_end);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail2;

  status = cff_dict_init (&top_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail2;

  element = _cairo_array_index (&index, 0);
  if (element == NULL((void*)0))
      goto fail3;
  status = cff_dict_read (top_dict, element->data, element->length);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      goto fail3;

  /* check for ROS operator indicating a CID font */
  if (cff_dict_get_operands (top_dict, ROS_OP0x0c1e, &size) != NULL((void*)0))
      is_cid = TRUE1;

3143fail3:
  cff_dict_fini (top_dict);

3146fail2:
  cff_index_fini (&index);

3149fail1:
  free (data);

  return is_cid;
3153}

3155static cairo_int_status_t
3156_cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset,
                               cairo_cff_font_t           **font_return,
                               const char                  *subset_name)
3159{
  cairo_status_t status;
  cairo_cff_font_t *font;

  font = calloc (1, sizeof (cairo_cff_font_t));
  if (unlikely (font == NULL)(__builtin_expect (!!(font == ((void*)0)), 0)))
3
←
Assuming 'font' is equal to null→
4
←
Taking true branch→
return _cairo_error (CAIRO_STATUS_NO_MEMORY);
5
←
Returning without writing to '*font_return'→

  font->backend = NULL((void*)0);
  font->scaled_font_subset = scaled_font_subset;

  _cairo_array_init (&font->output, sizeof (char));
  status = _cairo_array_grow_by (&font->output, 4096);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail1;

  font->subset_font_name = strdup (subset_name);
  if (unlikely (font->subset_font_name == NULL)(__builtin_expect (!!(font->subset_font_name == ((void*)0)
), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail1;
  }

  font->ps_name = strdup (subset_name);
  if (unlikely (font->ps_name == NULL)(__builtin_expect (!!(font->ps_name == ((void*)0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail2;
  }
  font->font_name = NULL((void*)0);

  font->x_min = 0;
  font->y_min = 0;
  font->x_max = 0;
  font->y_max = 0;
  font->ascent = 0;
  font->descent = 0;

  font->widths = calloc (font->scaled_font_subset->num_glyphs, sizeof (int));
  if (unlikely (font->widths == NULL)(__builtin_expect (!!(font->widths == ((void*)0)), 0))) {
      status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
      goto fail3;
  }

  font->data_length = 0;
  font->data = NULL((void*)0);
  font->data_end = NULL((void*)0);

  status = cff_dict_init (&font->top_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail4;

  status = cff_dict_init (&font->private_dict);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail5;

  cff_index_init (&font->strings_index);
  cff_index_init (&font->charstrings_index);
  cff_index_init (&font->global_sub_index);
  cff_index_init (&font->local_sub_index);
  cff_index_init (&font->charstrings_subset_index);
  cff_index_init (&font->strings_subset_index);
  font->global_subs_used = NULL((void*)0);
  font->local_subs_used = NULL((void*)0);
  font->subset_subroutines = FALSE0;
  font->fdselect = NULL((void*)0);
  font->fd_dict = NULL((void*)0);
  font->fd_private_dict = NULL((void*)0);
  font->fd_local_sub_index = NULL((void*)0);
  font->fdselect_subset = NULL((void*)0);
  font->fd_subset_map = NULL((void*)0);
  font->private_dict_offset = NULL((void*)0);

  *font_return = font;

  return CAIRO_STATUS_SUCCESS;

3234fail5:
  _cairo_hash_table_destroy (font->top_dict);
3236fail4:
  free (font->widths);
3238fail3:
  free (font->font_name);
  free (font->ps_name);
3241fail2:
  free (font->subset_font_name);
3243fail1:
  _cairo_array_fini (&font->output);
  free (font);
  return status;
3247}

3249static cairo_int_status_t
3250cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,
                                cairo_type2_charstrings_t  *type2_subset,
                                const char                **data,
                                unsigned long              *length)
3254{
  cairo_int_status_t status;
  cff_header_t header;
  cairo_array_t *charstring;
  unsigned char buf[40];
  unsigned char *end_buf, *end_buf2;
  unsigned int i;
  int sid;

  /* Create header */
  header.major = 1;
  header.minor = 0;
  header.header_size = 4;
  header.offset_size = 4;
  font->header = &header;
13
←
Access to field 'header' results in a dereference of a null pointer (loaded from variable 'font')

  /* Create Top Dict */
  font->is_cid = FALSE0;

  snprintf((char*)buf, sizeof(buf), "CairoFont-%u-%u",
    font->scaled_font_subset->font_id,
    font->scaled_font_subset->subset_id);
  sid = NUM_STD_STRINGS391 + _cairo_array_num_elements (&font->strings_subset_index);
  status = cff_index_append_copy (&font->strings_subset_index,
                                  (unsigned char *)buf,
                                  strlen((char*)buf));
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  end_buf = encode_integer (buf, sid);
  status = cff_dict_set_operands (font->top_dict, FULLNAME_OP0x0002,
		    buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  status = cff_dict_set_operands (font->top_dict, FAMILYNAME_OP0x0003,
		    buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  end_buf = encode_integer (buf, type2_subset->x_min);
  end_buf = encode_integer (end_buf, type2_subset->y_min);
  end_buf = encode_integer (end_buf, type2_subset->x_max);
  end_buf = encode_integer (end_buf, type2_subset->y_max);
  status = cff_dict_set_operands (font->top_dict,
                           FONTBBOX_OP0x0005, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  end_buf = encode_integer_max (buf, 0);
  status = cff_dict_set_operands (font->top_dict,
                           CHARSTRINGS_OP0x0011, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;


  if (font->scaled_font_subset->is_latin) {
status = cff_dict_set_operands (font->top_dict,
                                      ENCODING_OP0x0010, buf, end_buf - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

/* Private has two operands - size and offset */
end_buf2 = encode_integer_max (end_buf, 0);
cff_dict_set_operands (font->top_dict, PRIVATE_OP0x0012, buf, end_buf2 - buf);
      if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

  } else {
status = cff_dict_set_operands (font->top_dict,
			FDSELECT_OP0x0c25, buf, end_buf - buf);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

status = cff_dict_set_operands (font->top_dict,
			FDARRAY_OP0x0c24, buf, end_buf - buf);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  }

  status = cff_dict_set_operands (font->top_dict,
                           CHARSET_OP0x000f, buf, end_buf - buf);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
return status;

  if (!font->scaled_font_subset->is_latin) {
status = cairo_cff_font_set_ros_strings (font);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;

/* Create CID FD dictionary */
status = cairo_cff_font_create_cid_fontdict (font);
if (unlikely (status)(__builtin_expect (!!(status), 0)))
   return status;
  } else {
font->private_dict_offset = _cairo_malloc (sizeof (int))((sizeof (int)) != 0 ? malloc(sizeof (int)) : ((void*)0));
if (unlikely (font->private_dict_offset == NULL)(__builtin_expect (!!(font->private_dict_offset == ((void*
)0)), 0)))
   return _cairo_error (CAIRO_STATUS_NO_MEMORY);
  }

  /* Create charstrings */
  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++) {
      charstring = _cairo_array_index(&type2_subset->charstrings, i);

      status = cff_index_append (&font->charstrings_subset_index,
                                 _cairo_array_index (charstring, 0),
                                 _cairo_array_num_elements (charstring));

      if (unlikely (status)(__builtin_expect (!!(status), 0)))
          return status;
  }

  if (font->scaled_font_subset->is_latin)
status = cairo_cff_font_add_euro_charset_string (font);

  status = cairo_cff_font_write_subset (font);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
      return status;

  *data = _cairo_array_index (&font->output, 0);
  *length = _cairo_array_num_elements (&font->output);

  return CAIRO_STATUS_SUCCESS;
3377}

3379cairo_status_t
3380_cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
                        const char		      *subset_name,
                        cairo_scaled_font_subset_t  *font_subset)
3383{
  cairo_cff_font_t *font = NULL((void*)0); /* squelch bogus compiler warning */
1
'font' initialized to a null pointer value→
  cairo_status_t status;
  const char *data = NULL((void*)0); /* squelch bogus compiler warning */
  unsigned long length = 0; /* squelch bogus compiler warning */
  unsigned int i;
  cairo_type2_charstrings_t type2_subset;

  status = _cairo_cff_font_fallback_create (font_subset, &font, subset_name);
2
←
Calling '_cairo_cff_font_fallback_create'→
6
←
Returning from '_cairo_cff_font_fallback_create'→
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
7
←
Assuming 'status' is 0→
8
←
Taking false branch→
return status;

  status = _cairo_type2_charstrings_init (&type2_subset, font_subset);
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
9
←
Assuming 'status' is 0→
10
←
Taking false branch→
goto fail1;

  status = cairo_cff_font_fallback_generate (font, &type2_subset, &data, &length);
11
←
Passing null pointer value via 1st parameter 'font'→
12
←
Calling 'cairo_cff_font_fallback_generate'→
  if (unlikely (status)(__builtin_expect (!!(status), 0)))
goto fail2;

  cff_subset->family_name_utf8 = NULL((void*)0);
  cff_subset->ps_name = strdup (font->ps_name);
  if (unlikely (cff_subset->ps_name == NULL)(__builtin_expect (!!(cff_subset->ps_name == ((void*)0)), 0
))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail2;
  }

  cff_subset->widths = calloc (sizeof (double), font->scaled_font_subset->num_glyphs);
  if (unlikely (cff_subset->widths == NULL)(__builtin_expect (!!(cff_subset->widths == ((void*)0)), 0
))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail3;
  }

  for (i = 0; i < font->scaled_font_subset->num_glyphs; i++)
      cff_subset->widths[i] = (double)type2_subset.widths[i]/1000;

  cff_subset->x_min = (double)type2_subset.x_min/1000;
  cff_subset->y_min = (double)type2_subset.y_min/1000;
  cff_subset->x_max = (double)type2_subset.x_max/1000;
  cff_subset->y_max = (double)type2_subset.y_max/1000;
  cff_subset->ascent = (double)type2_subset.y_max/1000;
  cff_subset->descent = (double)type2_subset.y_min/1000;

  cff_subset->data = _cairo_malloc (length)((length) != 0 ? malloc(length) : ((void*)0));
  if (unlikely (cff_subset->data == NULL)(__builtin_expect (!!(cff_subset->data == ((void*)0)), 0))) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail4;
  }

  memcpy (cff_subset->data, data, length);
  cff_subset->data_length = length;

  _cairo_type2_charstrings_fini (&type2_subset);
  cairo_cff_font_destroy (font);

  return CAIRO_STATUS_SUCCESS;

fail4:
  free (cff_subset->widths);
fail3:
  free (cff_subset->ps_name);
fail2:
  _cairo_type2_charstrings_fini (&type2_subset);
fail1:
  cairo_cff_font_destroy (font);

  return status;
3450}

3452void
3453_cairo_cff_fallback_fini (cairo_cff_subset_t *subset)
3454{
  free (subset->ps_name);
  free (subset->widths);
  free (subset->data);
3458}

3460#endif /* CAIRO_HAS_FONT_SUBSET */