Merge branch 'release'

Author: josh-hadley

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+## Description
+
+Replace this text with a description of your changes, indicating whether
+it is a bug fix, enhancement, etc. and which general area(s) are affected
+(documentation, specific tool, group of tools, tests, etc.).
+
+If the contribution closes (fixes, resolves) a specific open
+[issue](https://github.com/adobe-type-tools/afdko/issues), please [link
+the issue](https://help.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword).
+
+## Checklist:
+
+- [ ] I have followed the [Contribution Guidelines](https://github.com/adobe-type-tools/afdko/blob/develop/CONTRIBUTING.md)
+- [ ] I have added **test code and data** to prove that my code functions correctly
+- [ ] I have verified that new and existing tests pass locally with my changes
+- [ ] I have performed a self-review of my own code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation

.github/workflows/asan.yml

@@ -0,0 +1,34 @@
+name: Test with ASAN
+
+on:
+  repository_dispatch:
+    types: asan-manual-trigger
+
+jobs:
+  run_asan:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v1
+      with:
+        submodules: true
+
+    - name: Set up Python
+      uses: actions/setup-python@v1
+      with:
+        python-version: 3.7
+
+    - name: Install multilib packages
+      run: sudo apt-get install gcc-multilib g++-multilib
+
+    - name: Set ASAN-related environment variables
+      run: echo '::set-env name=XFLAGS::-Og -g -fsanitize=address -fno-omit-frame-pointer'
+
+    - name: Install AFDKO and dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt -r requirements-dev.txt .
+        pip freeze --all
+
+    - name: Run tests
+      run: pytest tests

.gitignore

@@ -44,3 +44,6 @@ xcuserdata/
 **/visualstudio/Debug/*
 **/visualstudio/Release/*
 **/visualstudio/x64/*
+
+# temp output dirs created during tests
+**/temp_output

CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Adobe Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at [email protected]. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -11,6 +11,11 @@ Following are some guidelines and information about contributing, mostly so you
 
 ## How to contribute
 
+### Code of Conduct
+Please review our [Code of Conduct](./CODE_OF_CONDUCT.md)
+statement which explains standards and responsibilities for all contributors and
+project maintainers.
+
 ### Suggested areas
 If you'd like to contribute but are not sure where or how, here are some suggestions to get started:
  - Fix [active LGTM alerts](https://lgtm.com/projects/g/adobe-type-tools/afdko/alerts/?mode=list). Many of these are simple fixes and working through them is a great way to get familiar with the codebase.
@@ -24,7 +29,19 @@ First, **please check to see if [someone has already raised a similar question o
 You can also ask questions on the [AFDKO room in Gitter](https://gitter.im/adobe-type-tools/afdko) which is monitored by the AFDKO maintainers.
 
 ### Code Style
-Please see the [Code Style wiki page](https://github.com/adobe-type-tools/afdko/wiki/Code-Style) for guidelines. Note that automated processes will run `cpplint` on C/C++ code and `flake8` on Python code.
+Please see the [Code Style wiki
+page](https://github.com/adobe-type-tools/afdko/wiki/Code-Style) for guidelines.
+Note that automated processes will run `cpplint` on C/C++ code and `flake8` on
+Python code.
+
+### Testing, test code, and test data
+Contributions that add new functionality or substantially change existing
+functionality _must_ include test code and data that demonstrates that the
+contributed code functions as intended. But fonts and their interactions with
+systems and applications can be complicated, so simple tests aren't always
+sufficient. We encourage you to test your code on real fonts with tools,
+utilities, and applications outside of the AFDKO to ensure that your
+contribution produces font files that function correctly in real-world scenarios.
 
 ### Branches and Pull Requests
 All contributions are handled through the GitHub Pull Request process. You may do this directly via a branch of AFDKO's `develop` branch or via a fork of AFDKO.
@@ -33,8 +50,8 @@ In either case, submitting a Pull Request triggers a number of automated actions
 
 If you are contributing code, you should run the test suite locally and ensure that all tests pass. If you are contributing _a lot of code_ or introducing major changes, it is *essential* that you also add test cases to the test suite to ensure that your code is getting tested (review the contents of the [`tests`](./tests/) folder to get an idea of how to write tests). 100% coverage is not required, but you should add tests that demonstrate that new features/major changes are actually working as intended (and don't break existing tests). If you are contributing Python code, please pass it through [`flake8`](http://flake8.pycqa.org/en/latest/). If you are contributing C/C++ code, check with [`cpplint`](https://github.com/cpplint/cpplint).
 
-### Automated testing
-There are two main triggers for running automated tests:
+### Automation
+There are two main triggers for running automated tests for AFDKO:
  1. When any commit to _any_ branch is pushed to the main AFDKO repository
  2. When a Pull Request is submitted
 

NEWS.md

@@ -1,6 +1,67 @@
 Changelog
 =========
 
+3.5.0 (released 2020-07-16)
+----------------------
+- [docs] fix broken links, add new links, fix typos, add templates
+  ([#1140](https://github.com/adobe-type-tools/afdko/pull/1140),
+   [#1151](https://github.com/adobe-type-tools/afdko/pull/1151),
+   [#1176](https://github.com/adobe-type-tools/afdko/pull/1176))
+- [tx] many fixes related to uninitialized variables, buffer/stack overflows,
+  etc. Thanks to @antlarr-suse and internal contributors for chasing these down and fixing!
+  ([#1141](https://github.com/adobe-type-tools/afdko/pull/1141),
+   [#1180](https://github.com/adobe-type-tools/afdko/pull/1180),
+   [#1182](https://github.com/adobe-type-tools/afdko/pull/1182),
+   [#1187](https://github.com/adobe-type-tools/afdko/pull/1187),
+   [#1188](https://github.com/adobe-type-tools/afdko/pull/1188))
+- [makeotf] Drop Multiple Master in OpenType support (thanks @khaledhosny!)
+  ([#995](https://github.com/adobe-type-tools/afdko/issues/995),
+   [#1144](https://github.com/adobe-type-tools/afdko/pull/1144))
+- [checkoutlinesufo] Improve overlap removal
+  ([#790](https://github.com/adobe-type-tools/afdko/issues/790),
+   [#1146](https://github.com/adobe-type-tools/afdko/pull/1146),
+   [#1170](https://github.com/adobe-type-tools/afdko/pull/1170))
+- [fontsetplot, ttfdecomponentizer] Fix proofing issues
+  ([#1125](https://github.com/adobe-type-tools/afdko/issues/1125),
+   [#1148](https://github.com/adobe-type-tools/afdko/pull/1148))
+- [requirements] remove dependency on standalone cu2qu (integrated into
+  fontTools 4.7.0)
+  ([#1150](https://github.com/adobe-type-tools/afdko/pull/1150))
+- [makeinstancesufo] fix `use-varlib` flag, check for extrapolation/warn when
+  using varLib
+  ([#1152](https://github.com/adobe-type-tools/afdko/issues/1152),
+   [#1155](https://github.com/adobe-type-tools/afdko/pull/1155))
+- [makeotf] update a misleading comment regarding how CodePageRange bits are set
+  ([#1156](https://github.com/adobe-type-tools/afdko/issues/1156),
+   [#1157](https://github.com/adobe-type-tools/afdko/pull/1157))
+- [sfntedit, sfntdiff] fix failures with long file/pathnames
+  ([#1139](https://github.com/adobe-type-tools/afdko/issues/1139),
+   [#1159](https://github.com/adobe-type-tools/afdko/pull/1159))
+- [tx] don't write FontMatrix in CFF2 FontDict
+  ([cffsubr #13](https://github.com/adobe-type-tools/cffsubr/issues/13),
+   [#1165](https://github.com/adobe-type-tools/afdko/pull/1165))
+- [makeotf, makeotfexe] STAT table updates and improvements
+  ([#1164](https://github.com/adobe-type-tools/afdko/issues/1164),
+   [#1166](https://github.com/adobe-type-tools/afdko/pull/1166),
+   [#1174](https://github.com/adobe-type-tools/afdko/pull/1174),
+   [#1177](https://github.com/adobe-type-tools/afdko/issues/1177),
+   [#1178](https://github.com/adobe-type-tools/afdko/issues/1178),
+   [#1179](https://github.com/adobe-type-tools/afdko/pull/1179))
+- [makeotf] Check for PostScript name in FontMenuNameDB
+  ([#1171](https://github.com/adobe-type-tools/afdko/issues/1171),
+   [#1172](https://github.com/adobe-type-tools/afdko/pull/1172))
+- [autohint, stemhist] **REMOVED FROM AFDKO** (use psautohint/psstemhist)
+  ([#826](https://github.com/adobe-type-tools/afdko/issues/826),
+   [#827](https://github.com/adobe-type-tools/afdko/issues/827),
+   [#1175](https://github.com/adobe-type-tools/afdko/pull/1175))
+- [makeotfexe] fix stack buffer overflow and use-after-free issues
+  ([#1183](https://github.com/adobe-type-tools/afdko/pull/1183),
+   [#1184](https://github.com/adobe-type-tools/afdko/pull/1184))
+- [mergefonts] fix stack buffer overflow issue
+  ([#1185](https://github.com/adobe-type-tools/afdko/pull/1185))
+- [spot] fix heap buffer overflow issue
+  ([#1186](https://github.com/adobe-type-tools/afdko/pull/1186))
+
 3.4.0 (released 2020-05-26)
 ---------------------------
 - [makeotf] STAT table support (thanks @khaledhosny!)

c/makeotf/makeotf_lib/api/hotconv.h

@@ -12,7 +12,7 @@ This software is licensed as OpenSource, under the Apache License, Version 2.0.
 extern "C" {
 #endif
 
-#define HOT_VERSION 0x010072 /* Library version (1.0.114) */
+#define HOT_VERSION 0x010073 /* Library version (1.0.115) */
 /* Major, minor, build = (HOT_VERSION >> 16) & 0xff, (HOT_VERSION >> 8) & 0xff, HOT_VERSION & 0xff) */
 /* Warning: this string is now part of heuristic used by CoolType to identify the
 first round of CoolType fonts which had the backtrack sequence of a chaining
@@ -84,23 +84,6 @@ inside the (1,0,0) nameID 5 "Version: string. */
    hotConvert(ctx);
    hotFree(ctx);
 
-   Additional information required by multiple master fonts is added by calls
-   to hotAddAxisData(), hotAddStyleData(), and hotAddInstance(). Thus, a
-   multiple master conversion follows the following call sequence.
-
-   ctx = hotNew(...);
-   hotSetConvertFlags(ctx, hotConvFlags) // set flags before any hot unctions are called.
-   FontName = hotReadFont(ctx, ...);
-   hotAddName(ctx, ...);       // repeat for each name
-   hotAddMiscData(ctx, ...);
-   hotAddAxisData(ctx, ...);   // repeat for each axis
-   hotAddStyleData(ctx, ...);  // repeat for each style
-   hotAddInstance(ctx, ...);   // repeat for each instance
-   hotAddKernPair(ctx, ...);   // repeat for each pair
-   hotAddKernValue(ctx, ...);  // repeat for each value for each master
-   hotConvert(ctx);
-   hotFree(ctx);
-
    CJK fonts must specify horizontal and (optional) vertical Unicode
    information, as well as Macintosh encoding information. This is introduced
    by calls to hotAddCMap(). Thus, a CJK conversion has the following call
@@ -425,7 +408,6 @@ struct hotReadFontOverrides_           /* Record for instructions to modify font
 enum /* Font types */
 {
     hotSingleMaster,
-    hotMultipleMaster,
     hotCID
 };
 #define HOT_TYPE_MASK 0x0f /* Type returned in low 4 bits */
@@ -492,8 +474,6 @@ struct hotCommonData_ /* Miscellaneous data record */
 #define HOT_EURO_ADDED (1 << 8)        /* Flags Euro glyph added to CFF data */
     char *clientVers;
     long nKernPairs;
-    short nStyles;
-    short nInstances;
     hotEncoding *encoding;
     short fsSelectionMask_on;
     short fsSelectionMask_off;
@@ -510,14 +490,6 @@ struct hotCommonData_ /* Miscellaneous data record */
    The nKernPairs field specifies the number of kerning pairs to be
    subsequently added with hotAddKernPair().
 
-   The nStyles field specifies the number of styles to be subsequently
-   described with hotAddStyleData() and should be set to 0 for non-multiple
-   master fonts.
-
-   The nInstances field specifies the number of instances to be subsequently
-   added with hotAddInstance() and should be set to 0 for non-multiple master
-   fonts.
-
    The encoding field, along with hotMacData.encoding described below,
    specifies the encoding that the library should use to decode kern pairs
    added by hotAddKernPair(). If both fields are set to NULL, the library will
@@ -619,12 +591,10 @@ void hotAddKernPair(hotCtx g, long iPair, unsigned first, unsigned second);
    hotCommonData. (Unencoded character names are provided by calls to
    hotAddUnencChar().) */
 
-void hotAddKernValue(hotCtx g, long iPair, int iMaster, short value);
+void hotAddKernValue(hotCtx g, long iPair, short value);
 
 /* hotAddKernValue() adds a kerning value to the kerning pair specified by the
-   iPair argument for the master specified by the iMaster argument which
-   must have the value 0 for a single master font or in the range: 0 <= iMaster
-   < nMasters for multiple master fonts. */
+   iPair argument. */
 
 void hotAddUnencChar(hotCtx g, int iChar, char *name);
 
@@ -635,38 +605,6 @@ void hotAddUnencChar(hotCtx g, int iChar, char *name);
    glyphs of a kern pair with a name when one or both glyphs are unencoded.
    This name is subsequently converted into a glyph id by the library. */
 
-typedef int32_t hotFixed; /* 16.16 fixed point */
-void hotAddAxisData(hotCtx g, int iAxis,
-                    char *type, char *longLabel, char *shortLabel,
-                    hotFixed minRange, hotFixed maxRange);
-
-/* hotAddAxisData() adds information to an OTF font for the axis selected by
-   the iAxis argument which must be in the range: 0 <= iAxis < nAxes. The type
-   argument specifies the kind of axis as one of: "Weight", "Width",
-   "OpticalSize", or "Serif". The "longLabel" and "shortLabel" arguments
-   specify long and short name tags to be used in construction menu and font
-   names, e.g. "Weight" and " wt ". */
-
-void hotAddStyleData(hotCtx g, int iStyle, int iAxis, char *type,
-                     hotFixed point0, hotFixed delta0,
-                     hotFixed point1, hotFixed delta1);
-
-/* hotAddStyleData() adds style information to an OTF font for the axis
-   selected by the iAxis argument. The type argument specifies the style type
-   as one of: "Bold", "Italic", "Condensed", and "Extended". The point
-   arguments specify a coordinate on the axis and the "delta" arguments specify
-   the coordinate change from that point to a new coordinate that represents
-   the applied style. */
-
-void hotAddInstance(hotCtx g, int iInstance, char *suffix);
-
-/* hotAddInstance() adds instance information to an OTF font for the instance
-   selected by the "iInstance" argument which must be in the range: 0 <=
-   iInstance < nInstances. iInstance 0 must specify the default instance; other
-   instances may be added in any order. The "suffix" argument specifies an name
-   that may be concatenated with the 5-3-3 FontName to create an instance
-   FontName, e.g.  "367 RG 465 CN 11 OP". */
-
 typedef char *(*hotCMapId)(void *ctx);
 typedef char *(*hotCMapRefill)(void *ctx, long *count);
 void hotAddCMap(hotCtx g, hotCMapId id, hotCMapRefill refill);