From 65a0059b69385985896a24f407b3a791d33aef0f Mon Sep 17 00:00:00 2001
From: Masamichi Hosoda <trueroad@trueroad.jp>
Date: Thu, 27 Oct 2016 23:56:42 +0900
Subject: [PATCH] Issue 4989/2: Fix Type 1 (PFB) font embedding

Type 1 PFA data which is converted from PFB files can contain '\0'.

In order to avoid problems with '\0',
this commit makes to use the file length
instead of zero-terminated string.
---
 lily/include/font-metric.hh |  2 +-
 lily/pfb-scheme.cc          |  6 ++---
 lily/pfb.cc                 | 47 +++++++++++++++++--------------------
 3 files changed, 24 insertions(+), 31 deletions(-)

diff --git a/lily/include/font-metric.hh b/lily/include/font-metric.hh
index e385a1e7af..7a388f86f3 100644
--- a/lily/include/font-metric.hh
+++ b/lily/include/font-metric.hh
@@ -72,6 +72,6 @@ protected:
 };
 
 
-char *pfb2pfa (Byte const *pfb, int length);
+vector<char> pfb2pfa (const vector<char> &pfb);
 
 #endif /* FONT_METRIC_HH */
diff --git a/lily/pfb-scheme.cc b/lily/pfb-scheme.cc
index 0f96d63fb6..37e44da8b0 100644
--- a/lily/pfb-scheme.cc
+++ b/lily/pfb-scheme.cc
@@ -25,10 +25,8 @@ LY_DEFINE (ly_type1_2_pfa, "ly:type1->pfa",
   if ((Byte) type1_string[0] == 0x80)
     {
       /* The file is in PFB format. Convert it to PFA format. */
-      char *pfa = pfb2pfa ((Byte *) &type1_string[0],
-                           (int) type1_string.size ());
-      pfa_scm = scm_from_latin1_string (pfa);
-      free (pfa);
+      vector<char> pfa = pfb2pfa (type1_string);
+      pfa_scm = scm_from_latin1_stringn (&pfa[0], pfa.size ());
     }
   else
     {
diff --git a/lily/pfb.cc b/lily/pfb.cc
index c971024548..4f371c6c94 100644
--- a/lily/pfb.cc
+++ b/lily/pfb.cc
@@ -20,6 +20,8 @@
 #include <cstdlib>
 #include <cstdio>
 #include <cstring>
+#include <iomanip>
+#include <sstream>
 using namespace std;
 
 #include "program-option.hh"
@@ -29,55 +31,48 @@ using namespace std;
 #include "main.hh"
 #include "warn.hh"
 
-char *
-pfb2pfa (Byte const *pfb, int length)
+vector<char>
+pfb2pfa (const vector<char> &pfb)
 {
-  char *out = (char *) malloc (sizeof (char));
-  long olen = 0;
+  vector<char> out;
 
-  Byte const *p = pfb;
-  while (p < pfb + length)
+  vector<char>::const_iterator p = pfb.begin ();
+  while (p < pfb.end ())
     {
-      if (*p++ != 128)
+      if (static_cast<Byte>(*p++) != 128)
         break;
 
-      Byte type = *p++;
+      Byte type = static_cast<Byte>(*p++);
       if (type == 3)
         break;
 
-      unsigned seglen
-        = p[0] | (p[1] << 8)
-          | (p[2] << 16) | (p[3] << 24);
+      size_t seglen = static_cast<Byte>(*p++);
+      seglen |= (static_cast<Byte>(*p++) << 8);
+      seglen |= (static_cast<Byte>(*p++) << 16);
+      seglen |= (static_cast<Byte>(*p++) << 24);
 
-      p += 4;
       if (type == 1)
         {
-          out = (char *)realloc (out, olen + seglen + 1);
-          char *outp = out + olen;
-          memcpy (outp, p, seglen);
-          olen += seglen;
+          copy (p, p + seglen, back_inserter (out));
           p += seglen;
         }
       else if (type == 2)
         {
-          unsigned outlength = (seglen * 2) + (seglen / 32) + 2;
+          stringstream ss;
 
-          out = (char *)realloc (out, olen + outlength + 1);
+          ss << hex << setfill ('0');
 
-          char *outp = out + olen;
-          for (int i = seglen; i--;)
+          for (size_t i = seglen; i > 0; --i)
             {
-              sprintf (outp, "%02x", *p++);
-              outp += 2;
+              ss << setw (2) << static_cast<int>(static_cast<Byte>(*p++));
               if (! (i % 32))
-                *outp++ = '\n';
+                ss << '\n';
             }
 
-          olen = outp - out;
+          string str = ss.str ();
+          copy (str.begin (), str.end (), back_inserter (out));
         }
     }
-  out[olen] = 0;
 
   return out;
 }
-
-- 
2.39.2