Google Git
Sign in
chromium / external / ots / refs/tags/v9.2.0
tag04000793517e6b7868416dc1dcd5d0b7a0cd15c7
taggerKhaled Hosny <khaled@aliftype.com>Wed Oct 02 19:02:28 2024
object3b26b2e8b571a33739ee0c3553cb01c17ed62e23 
Version 9.2.0

* [glyph] Check & fix bounding box of simple glyph records. (#264, #266)
* [maxp] Attempt to improve fixup of bad 'maxp' version numbers. (#267)
* [CFF] correctly parse negative operands, but don't allow -ve offset. (#270)
* [COLR] Make rejecting paint-graph cycles in COLRv1 a compile-time
  option. (#272)
* [STAT] Don't check designAxisSize if the designAxisCount is zero. (#277)
* [gdef] absolute_offset could overflow a 16-bit variable. (#278)
* [name] Fix typos. (#280)
* [graphite] Avoid calling Serialize() for an invalid Glat table. (#281)
* [woff2] Set correct max_size for decompressed output buffer. (#284)
* [layout] Warn rather than fail if min/max of a condition table range
  are reversed. (#285)
* [meson] Update wrap files. (#286)
* Fix a size_t/off_t mismatch build warning. (#271)
* Fix potential arithmetic overflows. (#279)
commit3b26b2e8b571a33739ee0c3553cb01c17ed62e23[log] [tgz]
authorKhaled Hosny <khaled@aliftype.com>Wed Oct 02 18:19:53 2024
committerKhaled Hosny <khaled@aliftype.com>Wed Oct 02 19:02:14 2024
tree1eaf87472ea0a4ab70901d468f0b6beba6e7409a
parent4c5cfd9cceebb80aa940c4bb662aca333a5e2eb1 [diff]
9.2.0
1 file changed
tree: 1eaf87472ea0a4ab70901d468f0b6beba6e7409a
  1. .github/
  2. docs/
  3. include/
  4. src/
  5. subprojects/
  6. tests/
  7. util/
  8. .gitignore
  9. LICENSE
  10. meson.build
  11. meson_options.txt
  12. README.md
README.md

Build Fuzzing Status

OpenType Sanitizer

The OpenType Sanitizer (OTS) parses and serializes OpenType files (OTF, TTF) and WOFF and WOFF2 font files, validating them and sanitizing them as it goes.

The C library is integrated into Chromium and Firefox, and also simple command line tools to check files offline in a Terminal.

The CSS font-face property is great for web typography. Having to use images in order to get the correct typeface is a great sadness; one should be able to use vectors.

However, on many platforms the system-level TrueType font renderers have never been part of the attack surface before, and putting them on the front line is a scary proposition... Especially on platforms like Windows, where it's a closed-source blob running with high privilege.

Building from source

Instructions below are for building standalone OTS utilities, if you want to use OTS as a library then the recommended way is to copy the source code and integrate it into your existing build system. Our build system does not build a shared library intentionally.

Build OTS:

$ meson build
$ ninja -C build

Run the tests (if you wish):

$ ninja -C build test

Usage

See docs

Thanks to Alex Russell for the original idea.