Update freetype to 2.7.0

Tweak makefile for new freetype version

Force use of the v35 Freetype bytecode interpreter

18 files changed, 458 insertions, 292 deletions

diff --git a/freetype/src/type1/Jamfile b/freetype/src/type1/Jamfile
index 8e366baae..948b40854 100644
--- a/freetype/src/type1/Jamfile
+++ b/freetype/src/type1/Jamfile
@@ -1,6 +1,6 @@
 # FreeType 2 src/type1 Jamfile
 #
-# Copyright 2001 by
+# Copyright 2001-2016 by
 # David Turner, Robert Wilhelm, and Werner Lemberg.
 #
 # This file is part of the FreeType project, and may only be used, modified,
@@ -16,7 +16,13 @@ SubDir  FT2_TOP $(FT2_SRC_DIR) type1 ;
 
   if $(FT2_MULTI)
   {
-    _sources = t1afm t1driver t1objs t1load t1gload t1parse ;
+    _sources = t1afm
+               t1driver
+               t1gload
+               t1load
+               t1objs
+               t1parse
+               ;
   }
   else
   {
diff --git a/freetype/src/type1/module.mk b/freetype/src/type1/module.mk
index ade0210d7..d7ab520c7 100644
--- a/freetype/src/type1/module.mk
+++ b/freetype/src/type1/module.mk
@@ -3,7 +3,7 @@
 #
 
 
-# Copyright 1996-2000, 2006 by
+# Copyright 1996-2016 by
 # David Turner, Robert Wilhelm, and Werner Lemberg.
 #
 # This file is part of the FreeType project, and may only be used, modified,
diff --git a/freetype/src/type1/rules.mk b/freetype/src/type1/rules.mk
index 15087b030..bdec29479 100644
--- a/freetype/src/type1/rules.mk
+++ b/freetype/src/type1/rules.mk
@@ -3,7 +3,7 @@
 #
 
 
-# Copyright 1996-2000, 2001, 2003 by
+# Copyright 1996-2016 by
 # David Turner, Robert Wilhelm, and Werner Lemberg.
 #
 # This file is part of the FreeType project, and may only be used, modified,
@@ -20,7 +20,10 @@ T1_DIR := $(SRC_DIR)/type1
 
 # compilation flags for the driver
 #
-T1_COMPILE := $(FT_COMPILE) $I$(subst /,$(COMPILER_SEP),$(T1_DIR))
+T1_COMPILE := $(CC) $(ANSIFLAGS)                           \
+                    $I$(subst /,$(COMPILER_SEP),$(T1_DIR)) \
+                    $(INCLUDE_FLAGS)                       \
+                    $(FT_CFLAGS)
 
 
 # Type1 driver sources (i.e., C files)
diff --git a/freetype/src/type1/t1afm.c b/freetype/src/type1/t1afm.c
index de9c1997c..bbd843c1c 100644
--- a/freetype/src/type1/t1afm.c
+++ b/freetype/src/type1/t1afm.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    AFM support for Type 1 fonts (body).                                 */
 /*                                                                         */
-/*  Copyright 1996-2011, 2013 by                                           */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -169,8 +169,8 @@
       goto Exit;
 
     /* now, read each kern pair */
-    kp             = fi->KernPairs;
-    limit          = p + 4 * fi->NumKernPair;
+    kp    = fi->KernPairs;
+    limit = p + 4 * fi->NumKernPair;
 
     /* PFM kerning data are stored by encoding rather than glyph index, */
     /* so find the PostScript charmap of this font and install it       */
@@ -197,7 +197,7 @@
     /*   encoding of first glyph (1 byte)     */
     /*   encoding of second glyph (1 byte)    */
     /*   offset (little-endian short)         */
-    for ( ; p < limit ; p += 4 )
+    for ( ; p < limit; p += 4 )
     {
       kp->index1 = FT_Get_Char_Index( t1_face, p[0] );
       kp->index2 = FT_Get_Char_Index( t1_face, p[1] );
@@ -239,9 +239,19 @@
     AFM_ParserRec  parser;
     AFM_FontInfo   fi      = NULL;
     FT_Error       error   = FT_ERR( Unknown_File_Format );
-    T1_Font        t1_font = &( (T1_Face)t1_face )->type1;
+    T1_Face        face    = (T1_Face)t1_face;
+    T1_Font        t1_font = &face->type1;
 
 
+    if ( face->afm_data )
+    {
+      FT_TRACE1(( "T1_Read_Metrics:"
+                  " Freeing previously attached metrics data.\n" ));
+      T1_Done_Metrics( memory, (AFM_FontInfo)face->afm_data );
+
+      face->afm_data = NULL;
+    }
+
     if ( FT_NEW( fi )                   ||
          FT_FRAME_ENTER( stream->size ) )
       goto Exit;
@@ -250,7 +260,7 @@
     fi->Ascender  = t1_font->font_bbox.yMax;
     fi->Descender = t1_font->font_bbox.yMin;
 
-    psaux = (PSAux_Service)( (T1_Face)t1_face )->psaux;
+    psaux = (PSAux_Service)face->psaux;
     if ( psaux->afm_parser_funcs )
     {
       error = psaux->afm_parser_funcs->init( &parser,
@@ -298,7 +308,7 @@
       if ( fi->NumKernPair )
       {
         t1_face->face_flags |= FT_FACE_FLAG_KERNING;
-        ( (T1_Face)t1_face )->afm_data = fi;
+        face->afm_data       = fi;
         fi = NULL;
       }
     }
@@ -362,7 +372,7 @@
                         FT_Fixed*  kerning )
   {
     AFM_FontInfo  fi = (AFM_FontInfo)( (T1_Face)face )->afm_data;
-    FT_Int        i;
+    FT_UInt       i;
 
 
     if ( !fi )
diff --git a/freetype/src/type1/t1afm.h b/freetype/src/type1/t1afm.h
index 8eb1764de..3a864f237 100644
--- a/freetype/src/type1/t1afm.h
+++ b/freetype/src/type1/t1afm.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    AFM support for Type 1 fonts (specification).                        */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2006 by                                     */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1AFM_H__
-#define __T1AFM_H__
+#ifndef T1AFM_H_
+#define T1AFM_H_
 
 #include <ft2build.h>
 #include "t1objs.h"
@@ -48,7 +48,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1AFM_H__ */
+#endif /* T1AFM_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1driver.c b/freetype/src/type1/t1driver.c
index 2602bdb6f..f1e60d452 100644
--- a/freetype/src/type1/t1driver.c
+++ b/freetype/src/type1/t1driver.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 driver interface (body).                                      */
 /*                                                                         */
-/*  Copyright 1996-2004, 2006, 2007, 2009, 2011, 2013, 2014 by             */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -29,10 +29,11 @@
 
 #include FT_INTERNAL_DEBUG_H
 #include FT_INTERNAL_STREAM_H
+#include FT_INTERNAL_HASH_H
 
 #include FT_SERVICE_MULTIPLE_MASTERS_H
 #include FT_SERVICE_GLYPH_DICT_H
-#include FT_SERVICE_XFREE86_NAME_H
+#include FT_SERVICE_FONT_FORMAT_H
 #include FT_SERVICE_POSTSCRIPT_NAME_H
 #include FT_SERVICE_POSTSCRIPT_CMAPS_H
 #include FT_SERVICE_POSTSCRIPT_INFO_H
@@ -87,8 +88,8 @@
 
   static const FT_Service_GlyphDictRec  t1_service_glyph_dict =
   {
-    (FT_GlyphDict_GetNameFunc)  t1_get_glyph_name,
-    (FT_GlyphDict_NameIndexFunc)t1_get_name_index
+    (FT_GlyphDict_GetNameFunc)  t1_get_glyph_name,    /* get_name   */
+    (FT_GlyphDict_NameIndexFunc)t1_get_name_index     /* name_index */
   };
 
 
@@ -106,7 +107,7 @@
 
   static const FT_Service_PsFontNameRec  t1_service_ps_name =
   {
-    (FT_PsName_GetFunc)t1_get_ps_name
+    (FT_PsName_GetFunc)t1_get_ps_name     /* get_ps_font_name */
   };
 
 
@@ -118,11 +119,11 @@
 #ifndef T1_CONFIG_OPTION_NO_MM_SUPPORT
   static const FT_Service_MultiMastersRec  t1_service_multi_masters =
   {
-    (FT_Get_MM_Func)        T1_Get_Multi_Master,
-    (FT_Set_MM_Design_Func) T1_Set_MM_Design,
-    (FT_Set_MM_Blend_Func)  T1_Set_MM_Blend,
-    (FT_Get_MM_Var_Func)    T1_Get_MM_Var,
-    (FT_Set_Var_Design_Func)T1_Set_Var_Design
+    (FT_Get_MM_Func)        T1_Get_Multi_Master,   /* get_mm         */
+    (FT_Set_MM_Design_Func) T1_Set_MM_Design,      /* set_mm_design  */
+    (FT_Set_MM_Blend_Func)  T1_Set_MM_Blend,       /* set_mm_blend   */
+    (FT_Get_MM_Var_Func)    T1_Get_MM_Var,         /* get_mm_var     */
+    (FT_Set_Var_Design_Func)T1_Set_Var_Design      /* set_var_design */
   };
 #endif
 
@@ -176,9 +177,11 @@
                         PS_Dict_Keys  key,
                         FT_UInt       idx,
                         void         *value,
-                        FT_Long       value_len )
+                        FT_Long       value_len_ )
   {
-    FT_Long  retval = -1;
+    FT_ULong  retval    = 0; /* always >= 1 if valid */
+    FT_ULong  value_len = value_len_ < 0 ? 0 : (FT_ULong)value_len_;
+
     T1_Face  t1face = (T1_Face)face;
     T1_Font  type1  = &t1face->type1;
 
@@ -225,7 +228,7 @@
       if ( idx < sizeof ( type1->font_bbox ) /
                    sizeof ( type1->font_bbox.xMin ) )
       {
-        FT_Fixed val = 0;
+        FT_Fixed  val = 0;
 
 
         retval = sizeof ( val );
@@ -258,7 +261,7 @@
       break;
 
     case PS_DICT_FONT_NAME:
-      retval = (FT_Long)( ft_strlen( type1->font_name ) + 1 );
+      retval = ft_strlen( type1->font_name ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_name ), retval );
       break;
@@ -278,7 +281,7 @@
     case PS_DICT_CHAR_STRING_KEY:
       if ( idx < (FT_UInt)type1->num_glyphs )
       {
-        retval = (FT_Long)( ft_strlen( type1->glyph_names[idx] ) + 1 );
+        retval = ft_strlen( type1->glyph_names[idx] ) + 1;
         if ( value && value_len >= retval )
         {
           ft_memcpy( value, (void *)( type1->glyph_names[idx] ), retval );
@@ -290,7 +293,7 @@
     case PS_DICT_CHAR_STRING:
       if ( idx < (FT_UInt)type1->num_glyphs )
       {
-        retval = (FT_Long)( type1->charstrings_len[idx] + 1 );
+        retval = type1->charstrings_len[idx] + 1;
         if ( value && value_len >= retval )
         {
           ft_memcpy( value, (void *)( type1->charstrings[idx] ),
@@ -310,7 +313,7 @@
       if ( type1->encoding_type == T1_ENCODING_TYPE_ARRAY &&
            idx < (FT_UInt)type1->encoding.num_chars       )
       {
-        retval = (FT_Long)( ft_strlen( type1->encoding.char_name[idx] ) + 1 );
+        retval = ft_strlen( type1->encoding.char_name[idx] ) + 1;
         if ( value && value_len >= retval )
         {
           ft_memcpy( value, (void *)( type1->encoding.char_name[idx] ),
@@ -327,13 +330,37 @@
       break;
 
     case PS_DICT_SUBR:
-      if ( idx < (FT_UInt)type1->num_subrs )
       {
-        retval = (FT_Long)( type1->subrs_len[idx] + 1 );
-        if ( value && value_len >= retval )
+        FT_Bool  ok = 0;
+
+
+        if ( type1->subrs_hash )
         {
-          ft_memcpy( value, (void *)( type1->subrs[idx] ), retval - 1 );
-          ((FT_Char *)value)[retval - 1] = (FT_Char)'\0';
+          /* convert subr index to array index */
+          size_t*  val = ft_hash_num_lookup( (FT_Int)idx,
+                                             type1->subrs_hash );
+
+
+          if ( val )
+          {
+            idx = *val;
+            ok  = 1;
+          }
+        }
+        else
+        {
+          if ( idx < (FT_UInt)type1->num_subrs )
+            ok = 1;
+        }
+
+        if ( ok )
+        {
+          retval = type1->subrs_len[idx] + 1;
+          if ( value && value_len >= retval )
+          {
+            ft_memcpy( value, (void *)( type1->subrs[idx] ), retval - 1 );
+            ((FT_Char *)value)[retval - 1] = (FT_Char)'\0';
+          }
         }
       }
       break;
@@ -523,31 +550,31 @@
       break;
 
     case PS_DICT_VERSION:
-      retval = (FT_Long)( ft_strlen( type1->font_info.version ) + 1 );
+      retval = ft_strlen( type1->font_info.version ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_info.version ), retval );
       break;
 
     case PS_DICT_NOTICE:
-      retval = (FT_Long)( ft_strlen( type1->font_info.notice ) + 1 );
+      retval = ft_strlen( type1->font_info.notice ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_info.notice ), retval );
       break;
 
     case PS_DICT_FULL_NAME:
-      retval = (FT_Long)( ft_strlen( type1->font_info.full_name ) + 1 );
+      retval = ft_strlen( type1->font_info.full_name ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_info.full_name ), retval );
       break;
 
     case PS_DICT_FAMILY_NAME:
-      retval = (FT_Long)( ft_strlen( type1->font_info.family_name ) + 1 );
+      retval = ft_strlen( type1->font_info.family_name ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_info.family_name ), retval );
       break;
 
     case PS_DICT_WEIGHT:
-      retval = (FT_Long)( ft_strlen( type1->font_info.weight ) + 1 );
+      retval = ft_strlen( type1->font_info.weight ) + 1;
       if ( value && value_len >= retval )
         ft_memcpy( value, (void *)( type1->font_info.weight ), retval );
       break;
@@ -559,24 +586,24 @@
       break;
     }
 
-    return retval;
+    return retval == 0 ? -1 : (FT_Long)retval;
   }
 
 
   static const FT_Service_PsInfoRec  t1_service_ps_info =
   {
-    (PS_GetFontInfoFunc)   t1_ps_get_font_info,
-    (PS_GetFontExtraFunc)  t1_ps_get_font_extra,
-    (PS_HasGlyphNamesFunc) t1_ps_has_glyph_names,
-    (PS_GetFontPrivateFunc)t1_ps_get_font_private,
-    (PS_GetFontValueFunc)  t1_ps_get_font_value,
+    (PS_GetFontInfoFunc)   t1_ps_get_font_info,    /* ps_get_font_info    */
+    (PS_GetFontExtraFunc)  t1_ps_get_font_extra,   /* ps_get_font_extra   */
+    (PS_HasGlyphNamesFunc) t1_ps_has_glyph_names,  /* ps_has_glyph_names  */
+    (PS_GetFontPrivateFunc)t1_ps_get_font_private, /* ps_get_font_private */
+    (PS_GetFontValueFunc)  t1_ps_get_font_value,   /* ps_get_font_value   */
   };
 
 
 #ifndef T1_CONFIG_OPTION_NO_AFM
   static const FT_Service_KerningRec  t1_service_kerning =
   {
-    T1_Get_Track_Kerning,
+    T1_Get_Track_Kerning,       /* get_track */
   };
 #endif
 
@@ -590,7 +617,7 @@
   {
     { FT_SERVICE_ID_POSTSCRIPT_FONT_NAME, &t1_service_ps_name },
     { FT_SERVICE_ID_GLYPH_DICT,           &t1_service_glyph_dict },
-    { FT_SERVICE_ID_XF86_NAME,            FT_XF86_FORMAT_TYPE_1 },
+    { FT_SERVICE_ID_FONT_FORMAT,          FT_FONT_FORMAT_TYPE_1 },
     { FT_SERVICE_ID_POSTSCRIPT_INFO,      &t1_service_ps_info },
 
 #ifndef T1_CONFIG_OPTION_NO_AFM
@@ -687,36 +714,37 @@
       0x10000L,
       0x20000L,
 
-      0,   /* format interface */
+      0,    /* module-specific interface */
 
-      T1_Driver_Init,
-      T1_Driver_Done,
-      Get_Interface,
+      T1_Driver_Init,           /* FT_Module_Constructor  module_init   */
+      T1_Driver_Done,           /* FT_Module_Destructor   module_done   */
+      Get_Interface,            /* FT_Module_Requester    get_interface */
     },
 
     sizeof ( T1_FaceRec ),
     sizeof ( T1_SizeRec ),
     sizeof ( T1_GlyphSlotRec ),
 
-    T1_Face_Init,
-    T1_Face_Done,
-    T1_Size_Init,
-    T1_Size_Done,
-    T1_GlyphSlot_Init,
-    T1_GlyphSlot_Done,
+    T1_Face_Init,               /* FT_Face_InitFunc  init_face */
+    T1_Face_Done,               /* FT_Face_DoneFunc  done_face */
+    T1_Size_Init,               /* FT_Size_InitFunc  init_size */
+    T1_Size_Done,               /* FT_Size_DoneFunc  done_size */
+    T1_GlyphSlot_Init,          /* FT_Slot_InitFunc  init_slot */
+    T1_GlyphSlot_Done,          /* FT_Slot_DoneFunc  done_slot */
 
-    T1_Load_Glyph,
+    T1_Load_Glyph,              /* FT_Slot_LoadFunc  load_glyph */
 
 #ifdef T1_CONFIG_OPTION_NO_AFM
-    0,                     /* FT_Face_GetKerningFunc */
-    0,                     /* FT_Face_AttachFunc     */
+    0,                          /* FT_Face_GetKerningFunc   get_kerning  */
+    0,                          /* FT_Face_AttachFunc       attach_file  */
 #else
-    Get_Kerning,
-    T1_Read_Metrics,
+    Get_Kerning,                /* FT_Face_GetKerningFunc   get_kerning  */
+    T1_Read_Metrics,            /* FT_Face_AttachFunc       attach_file  */
 #endif
-    T1_Get_Advances,
-    T1_Size_Request,
-    0                      /* FT_Size_SelectFunc     */
+    T1_Get_Advances,            /* FT_Face_GetAdvancesFunc  get_advances */
+
+    T1_Size_Request,            /* FT_Size_RequestFunc  request_size */
+    0                           /* FT_Size_SelectFunc   select_size  */
   };
 
 
diff --git a/freetype/src/type1/t1driver.h b/freetype/src/type1/t1driver.h
index 639cd4a7a..78d8e38aa 100644
--- a/freetype/src/type1/t1driver.h
+++ b/freetype/src/type1/t1driver.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    High-level Type 1 driver interface (specification).                  */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002 by                                           */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1DRIVER_H__
-#define __T1DRIVER_H__
+#ifndef T1DRIVER_H_
+#define T1DRIVER_H_
 
 
 #include <ft2build.h>
@@ -36,7 +36,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1DRIVER_H__ */
+#endif /* T1DRIVER_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1errors.h b/freetype/src/type1/t1errors.h
index 8740530ee..9ba470ed6 100644
--- a/freetype/src/type1/t1errors.h
+++ b/freetype/src/type1/t1errors.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 error codes (specification only).                             */
 /*                                                                         */
-/*  Copyright 2001, 2012 by                                                */
+/*  Copyright 2001-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -22,12 +22,12 @@
   /*                                                                       */
   /*************************************************************************/
 
-#ifndef __T1ERRORS_H__
-#define __T1ERRORS_H__
+#ifndef T1ERRORS_H_
+#define T1ERRORS_H_
 
 #include FT_MODULE_ERRORS_H
 
-#undef __FTERRORS_H__
+#undef FTERRORS_H_
 
 #undef  FT_ERR_PREFIX
 #define FT_ERR_PREFIX  T1_Err_
@@ -35,7 +35,7 @@
 
 #include FT_ERRORS_H
 
-#endif /* __T1ERRORS_H__ */
+#endif /* T1ERRORS_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1gload.c b/freetype/src/type1/t1gload.c
index af102fd85..ea36f6414 100644
--- a/freetype/src/type1/t1gload.c
+++ b/freetype/src/type1/t1gload.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 Glyph Loader (body).                                          */
 /*                                                                         */
-/*  Copyright 1996-2006, 2008-2010, 2013, 2014 by                          */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -54,7 +54,7 @@
   /*************************************************************************/
 
 
-  FT_LOCAL_DEF( FT_Error )
+  static FT_Error
   T1_Parse_Glyph_And_Get_Char_String( T1_Decoder  decoder,
                                       FT_UInt     glyph_index,
                                       FT_Data*    char_string )
@@ -92,7 +92,7 @@
     if ( !error )
       error = decoder->funcs.parse_charstrings(
                 decoder, (FT_Byte*)char_string->pointer,
-                char_string->length );
+                (FT_UInt)char_string->length );
 
 #ifdef FT_CONFIG_OPTION_INCREMENTAL
 
@@ -183,6 +183,7 @@
     decoder.num_subrs     = type1->num_subrs;
     decoder.subrs         = type1->subrs;
     decoder.subrs_len     = type1->subrs_len;
+    decoder.subrs_hash    = type1->subrs_hash;
 
     decoder.buildchar     = face->buildchar;
     decoder.len_buildchar = face->len_buildchar;
@@ -194,7 +195,7 @@
     for ( glyph_index = 0; glyph_index < type1->num_glyphs; glyph_index++ )
     {
       /* now get load the unscaled outline */
-      (void)T1_Parse_Glyph( &decoder, glyph_index );
+      (void)T1_Parse_Glyph( &decoder, (FT_UInt)glyph_index );
       if ( glyph_index == 0 || decoder.builder.advance.x > *max_advance )
         *max_advance = decoder.builder.advance.x;
 
@@ -245,9 +246,10 @@
     decoder.builder.metrics_only = 1;
     decoder.builder.load_points  = 0;
 
-    decoder.num_subrs = type1->num_subrs;
-    decoder.subrs     = type1->subrs;
-    decoder.subrs_len = type1->subrs_len;
+    decoder.num_subrs  = type1->num_subrs;
+    decoder.subrs      = type1->subrs;
+    decoder.subrs_len  = type1->subrs_len;
+    decoder.subrs_hash = type1->subrs_hash;
 
     decoder.buildchar     = face->buildchar;
     decoder.len_buildchar = face->len_buildchar;
@@ -346,6 +348,7 @@
     decoder.num_subrs     = type1->num_subrs;
     decoder.subrs         = type1->subrs;
     decoder.subrs_len     = type1->subrs_len;
+    decoder.subrs_hash    = type1->subrs_hash;
 
     decoder.buildchar     = face->buildchar;
     decoder.len_buildchar = face->len_buildchar;
@@ -395,7 +398,6 @@
       {
         FT_BBox            cbox;
         FT_Glyph_Metrics*  metrics = &t1glyph->metrics;
-        FT_Vector          advance;
 
 
         /* copy the _unscaled_ advance width */
@@ -427,23 +429,26 @@
 
 #if 1
         /* apply the font matrix, if any */
-        if ( font_matrix.xx != 0x10000L || font_matrix.yy != font_matrix.xx ||
-             font_matrix.xy != 0        || font_matrix.yx != 0              )
+        if ( font_matrix.xx != 0x10000L || font_matrix.yy != 0x10000L ||
+             font_matrix.xy != 0        || font_matrix.yx != 0        )
+        {
           FT_Outline_Transform( &t1glyph->outline, &font_matrix );
 
+          metrics->horiAdvance = FT_MulFix( metrics->horiAdvance,
+                                            font_matrix.xx );
+          metrics->vertAdvance = FT_MulFix( metrics->vertAdvance,
+                                            font_matrix.yy );
+        }
+
         if ( font_offset.x || font_offset.y )
+        {
           FT_Outline_Translate( &t1glyph->outline,
                                 font_offset.x,
                                 font_offset.y );
 
-        advance.x = metrics->horiAdvance;
-        advance.y = 0;
-        FT_Vector_Transform( &advance, &font_matrix );
-        metrics->horiAdvance = advance.x + font_offset.x;
-        advance.x = 0;
-        advance.y = metrics->vertAdvance;
-        FT_Vector_Transform( &advance, &font_matrix );
-        metrics->vertAdvance = advance.y + font_offset.y;
+          metrics->horiAdvance += font_offset.x;
+          metrics->vertAdvance += font_offset.y;
+        }
 #endif
 
         if ( ( load_flags & FT_LOAD_NO_SCALE ) == 0 )
@@ -504,7 +509,7 @@
 
       /* Set the control data to null - it is no longer available if   */
       /* loaded incrementally.                                         */
-      t1glyph->control_data = 0;
+      t1glyph->control_data = NULL;
       t1glyph->control_len  = 0;
     }
 #endif
diff --git a/freetype/src/type1/t1gload.h b/freetype/src/type1/t1gload.h
index 0bdea3a8d..975f22785 100644
--- a/freetype/src/type1/t1gload.h
+++ b/freetype/src/type1/t1gload.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 Glyph Loader (specification).                                 */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2008, 2011 by                         */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1GLOAD_H__
-#define __T1GLOAD_H__
+#ifndef T1GLOAD_H_
+#define T1GLOAD_H_
 
 
 #include <ft2build.h>
@@ -47,7 +47,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1GLOAD_H__ */
+#endif /* T1GLOAD_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1load.c b/freetype/src/type1/t1load.c
index 22b3f6b31..e728cf450 100644
--- a/freetype/src/type1/t1load.c
+++ b/freetype/src/type1/t1load.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 font loader (body).                                           */
 /*                                                                         */
-/*  Copyright 1996-2014 by                                                 */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -66,6 +66,7 @@
 #include FT_MULTIPLE_MASTERS_H
 #include FT_INTERNAL_TYPE1_TYPES_H
 #include FT_INTERNAL_CALC_H
+#include FT_INTERNAL_HASH_H
 
 #include "t1load.h"
 #include "t1errors.h"
@@ -226,7 +227,7 @@
   /* Given a normalized (blend) coordinate, figure out the design          */
   /* coordinate appropriate for that value.                                */
   /*                                                                       */
-  FT_LOCAL_DEF( FT_Fixed )
+  static FT_Fixed
   mm_axis_unmap( PS_DesignMap  axismap,
                  FT_Fixed      ncv )
   {
@@ -255,7 +256,7 @@
   /* Given a vector of weights, one for each design, figure out the        */
   /* normalized axis coordinates which gave rise to those weights.         */
   /*                                                                       */
-  FT_LOCAL_DEF( void )
+  static void
   mm_weights_unmap( FT_Fixed*  weights,
                     FT_Fixed*  axiscoords,
                     FT_UInt    axis_count )
@@ -320,12 +321,12 @@
 
     mmvar->num_axis        = mmaster.num_axis;
     mmvar->num_designs     = mmaster.num_designs;
-    mmvar->num_namedstyles = ~0U;                        /* Does not apply */
+    mmvar->num_namedstyles = 0;                           /* Not supported */
     mmvar->axis            = (FT_Var_Axis*)&mmvar[1];
                                       /* Point to axes after MM_Var struct */
     mmvar->namedstyle      = NULL;
 
-    for ( i = 0 ; i < mmaster.num_axis; ++i )
+    for ( i = 0; i < mmaster.num_axis; ++i )
     {
       mmvar->axis[i].name    = mmaster.axis[i].name;
       mmvar->axis[i].minimum = INT_TO_FIXED( mmaster.axis[i].minimum);
@@ -336,6 +337,9 @@
       mmvar->axis[i].strid   = ~0U;                      /* Does not apply */
       mmvar->axis[i].tag     = ~0U;                      /* Does not apply */
 
+      if ( !mmvar->axis[i].name )
+        continue;
+
       if ( ft_strcmp( mmvar->axis[i].name, "Weight" ) == 0 )
         mmvar->axis[i].tag = FT_MAKE_TAG( 'w', 'g', 'h', 't' );
       else if ( ft_strcmp( mmvar->axis[i].name, "Width" ) == 0 )
@@ -368,44 +372,43 @@
                    FT_Fixed*  coords )
   {
     PS_Blend  blend = face->blend;
-    FT_Error  error;
     FT_UInt   n, m;
 
 
-    error = FT_ERR( Invalid_Argument );
+    if ( !blend )
+      return FT_THROW( Invalid_Argument );
+
+    if ( num_coords > blend->num_axis )
+      num_coords = blend->num_axis;
 
-    if ( blend && blend->num_axis == num_coords )
+    /* recompute the weight vector from the blend coordinates */
+    for ( n = 0; n < blend->num_designs; n++ )
     {
-      /* recompute the weight vector from the blend coordinates */
-      for ( n = 0; n < blend->num_designs; n++ )
-      {
-        FT_Fixed  result = 0x10000L;  /* 1.0 fixed */
+      FT_Fixed  result = 0x10000L;  /* 1.0 fixed */
 
 
-        for ( m = 0; m < blend->num_axis; m++ )
-        {
-          FT_Fixed  factor;
+      for ( m = 0; m < blend->num_axis; m++ )
+      {
+        FT_Fixed  factor;
 
 
-          /* get current blend axis position */
-          factor = coords[m];
-          if ( factor < 0 )
-            factor = 0;
-          if ( factor > 0x10000L )
-            factor = 0x10000L;
+        /* get current blend axis position;                  */
+        /* use a default value if we don't have a coordinate */
+        factor = m < num_coords ? coords[m] : 0x8000;
+        if ( factor < 0 )
+          factor = 0;
+        if ( factor > 0x10000L )
+          factor = 0x10000L;
 
-          if ( ( n & ( 1 << m ) ) == 0 )
-            factor = 0x10000L - factor;
+        if ( ( n & ( 1 << m ) ) == 0 )
+          factor = 0x10000L - factor;
 
-          result = FT_MulFix( result, factor );
-        }
-        blend->weight_vector[n] = result;
+        result = FT_MulFix( result, factor );
       }
-
-      error = FT_Err_Ok;
+      blend->weight_vector[n] = result;
     }
 
-    return error;
+    return FT_Err_Ok;
   }
 
 
@@ -415,68 +418,72 @@
                     FT_Long*  coords )
   {
     PS_Blend  blend = face->blend;
-    FT_Error  error;
     FT_UInt   n, p;
+    FT_Fixed  final_blends[T1_MAX_MM_DESIGNS];
 
 
-    error = FT_ERR( Invalid_Argument );
-    if ( blend && blend->num_axis == num_coords )
-    {
-      /* compute the blend coordinates through the blend design map */
-      FT_Fixed  final_blends[T1_MAX_MM_DESIGNS];
+    if ( !blend )
+      return FT_THROW( Invalid_Argument );
 
+    if ( num_coords > blend->num_axis )
+      num_coords = blend->num_axis;
 
-      for ( n = 0; n < blend->num_axis; n++ )
-      {
-        FT_Long       design  = coords[n];
-        FT_Fixed      the_blend;
-        PS_DesignMap  map     = blend->design_map + n;
-        FT_Long*      designs = map->design_points;
-        FT_Fixed*     blends  = map->blend_points;
-        FT_Int        before  = -1, after = -1;
+    /* compute the blend coordinates through the blend design map */
 
+    for ( n = 0; n < blend->num_axis; n++ )
+    {
+      FT_Long       design;
+      FT_Fixed      the_blend;
+      PS_DesignMap  map     = blend->design_map + n;
+      FT_Long*      designs = map->design_points;
+      FT_Fixed*     blends  = map->blend_points;
+      FT_Int        before  = -1, after = -1;
 
-        for ( p = 0; p < (FT_UInt)map->num_points; p++ )
-        {
-          FT_Long  p_design = designs[p];
 
+      /* use a default value if we don't have a coordinate */
+      if ( n < num_coords )
+        design = coords[n];
+      else
+        design = ( designs[map->num_points - 1] - designs[0] ) / 2;
 
-          /* exact match? */
-          if ( design == p_design )
-          {
-            the_blend = blends[p];
-            goto Found;
-          }
+      for ( p = 0; p < (FT_UInt)map->num_points; p++ )
+      {
+        FT_Long  p_design = designs[p];
 
-          if ( design < p_design )
-          {
-            after = p;
-            break;
-          }
 
-          before = p;
+        /* exact match? */
+        if ( design == p_design )
+        {
+          the_blend = blends[p];
+          goto Found;
         }
 
-        /* now interpolate if necessary */
-        if ( before < 0 )
-          the_blend = blends[0];
+        if ( design < p_design )
+        {
+          after = (FT_Int)p;
+          break;
+        }
 
-        else if ( after < 0 )
-          the_blend = blends[map->num_points - 1];
+        before = (FT_Int)p;
+      }
 
-        else
-          the_blend = FT_MulDiv( design         - designs[before],
-                                 blends [after] - blends [before],
-                                 designs[after] - designs[before] );
+      /* now interpolate if necessary */
+      if ( before < 0 )
+        the_blend = blends[0];
 
-      Found:
-        final_blends[n] = the_blend;
-      }
+      else if ( after < 0 )
+        the_blend = blends[map->num_points - 1];
 
-      error = T1_Set_MM_Blend( face, num_coords, final_blends );
+      else
+        the_blend = FT_MulDiv( design         - designs[before],
+                               blends [after] - blends [before],
+                               designs[after] - designs[before] );
+
+    Found:
+      final_blends[n] = the_blend;
     }
 
-    return error;
+    return T1_Set_MM_Blend( face, blend->num_axis, final_blends );
   }
 
 
@@ -490,20 +497,17 @@
                      FT_UInt    num_coords,
                      FT_Fixed*  coords )
   {
-     FT_Long   lcoords[4];          /* maximum axis count is 4 */
-     FT_UInt   i;
-     FT_Error  error;
+     FT_Long  lcoords[T1_MAX_MM_AXIS];
+     FT_UInt  i;
+
 
+     if ( num_coords > T1_MAX_MM_AXIS )
+       num_coords = T1_MAX_MM_AXIS;
 
-     error = FT_ERR( Invalid_Argument );
-     if ( num_coords <= 4 && num_coords > 0 )
-     {
-       for ( i = 0; i < num_coords; ++i )
-         lcoords[i] = FIXED_TO_INT( coords[i] );
-       error = T1_Set_MM_Design( face, num_coords, lcoords );
-     }
+     for ( i = 0; i < num_coords; ++i )
+       lcoords[i] = FIXED_TO_INT( coords[i] );
 
-     return error;
+     return T1_Set_MM_Design( face, num_coords, lcoords );
   }
 
 
@@ -599,23 +603,32 @@
     /* each token is an immediate containing the name of the axis */
     for ( n = 0; n < num_axis; n++ )
     {
-      T1_Token    token = axis_tokens + n;
-      FT_Byte*    name;
-      FT_PtrDist  len;
+      T1_Token  token = axis_tokens + n;
+      FT_Byte*  name;
+      FT_UInt   len;
 
 
       /* skip first slash, if any */
       if ( token->start[0] == '/' )
         token->start++;
 
-      len = token->limit - token->start;
+      len = (FT_UInt)( token->limit - token->start );
       if ( len == 0 )
       {
         error = FT_THROW( Invalid_File_Format );
         goto Exit;
       }
 
-      if ( FT_ALLOC( blend->axis_names[n], (FT_Long)( len + 1 ) ) )
+      name = (FT_Byte*)blend->axis_names[n];
+      if ( name )
+      {
+        FT_TRACE0(( "parse_blend_axis_types:"
+                    " overwriting axis name `%s' with `%*.s'\n",
+                    name, len, token->start ));
+        FT_FREE( name );
+      }
+
+      if ( FT_ALLOC( blend->axis_names[n], len + 1 ) )
         goto Exit;
 
       name = (FT_Byte*)blend->axis_names[n];
@@ -692,7 +705,9 @@
           }
 
           num_axis = n_axis;
-          error = t1_allocate_blend( face, num_designs, num_axis );
+          error = t1_allocate_blend( face,
+                                     (FT_UInt)num_designs,
+                                     (FT_UInt)num_axis );
           if ( error )
             goto Exit;
           blend = face->blend;
@@ -757,7 +772,7 @@
     old_cursor = parser->root.cursor;
     old_limit  = parser->root.limit;
 
-    error = t1_allocate_blend( face, 0, num_axis );
+    error = t1_allocate_blend( face, 0, (FT_UInt)num_axis );
     if ( error )
       goto Exit;
     blend = face->blend;
@@ -785,6 +800,13 @@
         goto Exit;
       }
 
+      if ( map->design_points )
+      {
+        FT_ERROR(( "parse_blend_design_map: duplicate table\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Exit;
+      }
+
       /* allocate design map data */
       if ( FT_NEW_ARRAY( map->design_points, num_points * 2 ) )
         goto Exit;
@@ -848,7 +870,7 @@
 
     if ( !blend || !blend->num_designs )
     {
-      error = t1_allocate_blend( face, num_designs, 0 );
+      error = t1_allocate_blend( face, (FT_UInt)num_designs, 0 );
       if ( error )
         goto Exit;
       blend = face->blend;
@@ -890,8 +912,8 @@
   parse_buildchar( T1_Face    face,
                    T1_Loader  loader )
   {
-    face->len_buildchar = T1_ToFixedArray( &loader->parser, 0, NULL, 0 );
-
+    face->len_buildchar = (FT_UInt)T1_ToFixedArray( &loader->parser,
+                                                    0, NULL, 0 );
     return;
   }
 
@@ -1038,9 +1060,11 @@
   }
 
 
+  /* return 1 in case of success */
+
   static int
   read_binary_data( T1_Parser  parser,
-                    FT_Long*   size,
+                    FT_ULong*  size,
                     FT_Byte**  base,
                     FT_Bool    incremental )
   {
@@ -1072,7 +1096,7 @@
       if ( s >= 0 && s < limit - *base )
       {
         parser->root.cursor += s + 1;
-        *size = s;
+        *size = (FT_ULong)s;
         return !parser->root.error;
       }
     }
@@ -1103,6 +1127,7 @@
     FT_Int      result;
 
 
+    /* input is scaled by 1000 to accommodate default FontMatrix */
     result = T1_ToFixedArray( parser, 6, temp, 3 );
 
     if ( result < 6 )
@@ -1120,15 +1145,12 @@
       return;
     }
 
-    /* Set Units per EM based on FontMatrix values.  We set the value to */
-    /* 1000 / temp_scale, because temp_scale was already multiplied by   */
-    /* 1000 (in t1_tofixed, from psobjs.c).                              */
-
-    root->units_per_EM = (FT_UShort)FT_DivFix( 1000, temp_scale );
-
-    /* we need to scale the values by 1.0/temp_scale */
+    /* atypical case */
     if ( temp_scale != 0x10000L )
     {
+      /* set units per EM based on FontMatrix values */
+      root->units_per_EM = (FT_UShort)FT_DivFix( 1000, temp_scale );
+
       temp[0] = FT_DivFix( temp[0], temp_scale );
       temp[1] = FT_DivFix( temp[1], temp_scale );
       temp[2] = FT_DivFix( temp[2], temp_scale );
@@ -1190,10 +1212,27 @@
       else
         count = (FT_Int)T1_ToInt( parser );
 
+      /* only composite fonts (which we don't support) */
+      /* can have larger values                        */
+      if ( count > 256 )
+      {
+        FT_ERROR(( "parse_encoding: invalid encoding array size\n" ));
+        parser->root.error = FT_THROW( Invalid_File_Format );
+        return;
+      }
+
       T1_Skip_Spaces( parser );
       if ( parser->root.cursor >= limit )
         return;
 
+      /* PostScript happily allows overwriting of encoding arrays */
+      if ( encode->char_index )
+      {
+        FT_FREE( encode->char_index );
+        FT_FREE( encode->char_name );
+        T1_Release_Table( char_table );
+      }
+
       /* we use a T1_Table to store our charnames */
       loader->num_chars = encode->num_chars = count;
       if ( FT_NEW_ARRAY( encode->char_index, count )     ||
@@ -1285,7 +1324,7 @@
 
           if ( cur + 2 < limit && *cur == '/' && n < count )
           {
-            FT_PtrDist  len;
+            FT_UInt  len;
 
 
             cur++;
@@ -1297,7 +1336,7 @@
             if ( parser->root.error )
               return;
 
-            len = parser->root.cursor - cur;
+            len = (FT_UInt)( parser->root.cursor - cur );
 
             parser->root.error = T1_Add_Table( char_table, charcode,
                                                cur, len + 1 );
@@ -1366,6 +1405,8 @@
     FT_Memory  memory = parser->root.memory;
     FT_Error   error;
     FT_Int     num_subrs;
+    FT_UInt    count;
+    FT_Hash    hash = NULL;
 
     PSAux_Service  psaux = (PSAux_Service)face->psaux;
 
@@ -1385,6 +1426,49 @@
     }
 
     num_subrs = (FT_Int)T1_ToInt( parser );
+    if ( num_subrs < 0 )
+    {
+      parser->root.error = FT_THROW( Invalid_File_Format );
+      return;
+    }
+
+    /* we certainly need more than 8 bytes per subroutine */
+    if ( parser->root.limit > parser->root.cursor                      &&
+         num_subrs > ( parser->root.limit - parser->root.cursor ) >> 3 )
+    {
+      /*
+       * There are two possibilities.  Either the font contains an invalid
+       * value for `num_subrs', or we have a subsetted font where the
+       * subroutine indices are not adjusted, e.g.
+       *
+       *   /Subrs 812 array
+       *     dup 0 { ... } NP
+       *     dup 51 { ... } NP
+       *     dup 681 { ... } NP
+       *   ND
+       *
+       * In both cases, we use a number hash that maps from subr indices to
+       * actual array elements.
+       */
+
+      FT_TRACE0(( "parse_subrs: adjusting number of subroutines"
+                  " (from %d to %d)\n",
+                  num_subrs,
+                  ( parser->root.limit - parser->root.cursor ) >> 3 ));
+      num_subrs = ( parser->root.limit - parser->root.cursor ) >> 3;
+
+      if ( !hash )
+      {
+        if ( FT_NEW( hash ) )
+          goto Fail;
+
+        loader->subrs_hash = hash;
+
+        error = ft_hash_num_init( hash, memory );
+        if ( error )
+          goto Fail;
+      }
+    }
 
     /* position the parser right before the `dup' of the first subr */
     T1_Skip_PS_Token( parser );         /* `array' */
@@ -1405,9 +1489,10 @@
     /*                         */
     /*   `index' + binary data */
     /*                         */
-    for (;;)
+    for ( count = 0; ; count++ )
     {
-      FT_Long   idx, size;
+      FT_Long   idx;
+      FT_ULong  size;
       FT_Byte*  base;
 
 
@@ -1440,6 +1525,14 @@
         T1_Skip_Spaces  ( parser );
       }
 
+      /* if we use a hash, the subrs index is the key, and a running */
+      /* counter specified for `T1_Add_Table' acts as the value      */
+      if ( hash )
+      {
+        ft_hash_num_insert( idx, count, hash, memory );
+        idx = count;
+      }
+
       /* with synthetic fonts it is possible we get here twice */
       if ( loader->num_subrs )
         continue;
@@ -1451,13 +1544,13 @@
       /*                                                         */
       if ( face->type1.private_dict.lenIV >= 0 )
       {
-        FT_Byte*  temp;
+        FT_Byte*  temp = NULL;
 
 
         /* some fonts define empty subr records -- this is not totally */
         /* compliant to the specification (which says they should at   */
         /* least contain a `return'), but we support them anyway       */
-        if ( size < face->type1.private_dict.lenIV )
+        if ( size < (FT_ULong)face->type1.private_dict.lenIV )
         {
           error = FT_THROW( Invalid_File_Format );
           goto Fail;
@@ -1468,7 +1561,7 @@
           goto Fail;
         FT_MEM_COPY( temp, base, size );
         psaux->t1_decrypt( temp, size, 4330 );
-        size -= face->type1.private_dict.lenIV;
+        size -= (FT_ULong)face->type1.private_dict.lenIV;
         error = T1_Add_Table( table, (FT_Int)idx,
                               temp + face->type1.private_dict.lenIV, size );
         FT_FREE( temp );
@@ -1505,10 +1598,10 @@
 
     PSAux_Service  psaux        = (PSAux_Service)face->psaux;
 
-    FT_Byte*       cur;
+    FT_Byte*       cur          = parser->root.cursor;
     FT_Byte*       limit        = parser->root.limit;
     FT_Int         n, num_glyphs;
-    FT_UInt        notdef_index = 0;
+    FT_Int         notdef_index = 0;
     FT_Byte        notdef_found = 0;
 
 
@@ -1519,6 +1612,15 @@
       goto Fail;
     }
 
+    /* we certainly need more than 8 bytes per glyph */
+    if ( num_glyphs > ( limit - cur ) >> 3 )
+    {
+      FT_TRACE0(( "parse_charstrings: adjusting number of glyphs"
+                  " (from %d to %d)\n",
+                  num_glyphs, ( limit - cur ) >> 3 ));
+      num_glyphs = ( limit - cur ) >> 3;
+    }
+
     /* some fonts like Optima-Oblique not only define the /CharStrings */
     /* array but access it also                                        */
     if ( num_glyphs == 0 || parser->root.error )
@@ -1555,7 +1657,7 @@
 
     for (;;)
     {
-      FT_Long   size;
+      FT_ULong  size;
       FT_Byte*  base;
 
 
@@ -1606,7 +1708,7 @@
 
       if ( *cur == '/' )
       {
-        FT_PtrDist  len;
+        FT_UInt  len;
 
 
         if ( cur + 2 >= limit )
@@ -1616,7 +1718,7 @@
         }
 
         cur++;                              /* skip `/' */
-        len = parser->root.cursor - cur;
+        len = (FT_UInt)( parser->root.cursor - cur );
 
         if ( !read_binary_data( parser, &size, &base, IS_INCREMENTAL ) )
           return;
@@ -1646,10 +1748,10 @@
         if ( face->type1.private_dict.lenIV >= 0 &&
              n < num_glyphs + TABLE_EXTEND       )
         {
-          FT_Byte*  temp;
+          FT_Byte*  temp = NULL;
 
 
-          if ( size <= face->type1.private_dict.lenIV )
+          if ( size <= (FT_ULong)face->type1.private_dict.lenIV )
           {
             error = FT_THROW( Invalid_File_Format );
             goto Fail;
@@ -1660,7 +1762,7 @@
             goto Fail;
           FT_MEM_COPY( temp, base, size );
           psaux->t1_decrypt( temp, size, 4330 );
-          size -= face->type1.private_dict.lenIV;
+          size -= (FT_ULong)face->type1.private_dict.lenIV;
           error = T1_Add_Table( code_table, n,
                                 temp + face->type1.private_dict.lenIV, size );
           FT_FREE( temp );
@@ -1674,6 +1776,12 @@
       }
     }
 
+    if ( !n )
+    {
+      error = FT_THROW( Invalid_File_Format );
+      goto Fail;
+    }
+
     loader->num_glyphs = n;
 
     /* if /.notdef is found but does not occupy index 0, do our magic. */
@@ -1838,15 +1946,11 @@
   };
 
 
-#define T1_FIELD_COUNT                                           \
-          ( sizeof ( t1_keywords ) / sizeof ( t1_keywords[0] ) )
-
-
   static FT_Error
   parse_dict( T1_Face    face,
               T1_Loader  loader,
               FT_Byte*   base,
-              FT_Long    size )
+              FT_ULong   size )
   {
     T1_Parser  parser = &loader->parser;
     FT_Byte   *limit, *start_binary = NULL;
@@ -1902,7 +2006,7 @@
       else if ( *cur == 'R' && cur + 6 < limit && *(cur + 1) == 'D' &&
                 have_integer )
       {
-        FT_Long   s;
+        FT_ULong  s;
         FT_Byte*  b;
 
 
@@ -1915,7 +2019,7 @@
       else if ( *cur == '-' && cur + 6 < limit && *(cur + 1) == '|' &&
                 have_integer )
       {
-        FT_Long   s;
+        FT_ULong  s;
         FT_Byte*  b;
 
 
@@ -1928,7 +2032,7 @@
       /* look for immediates */
       else if ( *cur == '/' && cur + 2 < limit )
       {
-        FT_PtrDist  len;
+        FT_UInt  len;
 
 
         cur++;
@@ -1938,7 +2042,7 @@
         if ( parser->root.error )
           goto Exit;
 
-        len = parser->root.cursor - cur;
+        len = (FT_UInt)( parser->root.cursor - cur );
 
         if ( len > 0 && len < 22 && parser->root.cursor < limit )
         {
@@ -1955,9 +2059,9 @@
             if ( !name )
               break;
 
-            if ( cur[0] == name[0]                                  &&
-                 len == (FT_PtrDist)ft_strlen( (const char *)name ) &&
-                 ft_memcmp( cur, name, len ) == 0                   )
+            if ( cur[0] == name[0]                      &&
+                 len == ft_strlen( (const char *)name ) &&
+                 ft_memcmp( cur, name, len ) == 0       )
             {
               /* We found it -- run the parsing callback!     */
               /* We record every instance of every field      */
@@ -2046,17 +2150,6 @@
     FT_UNUSED( face );
 
     FT_MEM_ZERO( loader, sizeof ( *loader ) );
-    loader->num_glyphs = 0;
-    loader->num_chars  = 0;
-
-    /* initialize the tables -- simply set their `init' field to 0 */
-    loader->encoding_table.init  = 0;
-    loader->charstrings.init     = 0;
-    loader->glyph_names.init     = 0;
-    loader->subrs.init           = 0;
-    loader->swap_table.init      = 0;
-    loader->fontdata             = 0;
-    loader->keywords_encountered = 0;
   }
 
 
@@ -2064,6 +2157,7 @@
   t1_done_loader( T1_Loader  loader )
   {
     T1_Parser  parser = &loader->parser;
+    FT_Memory  memory = parser->root.memory;
 
 
     /* finalize tables */
@@ -2073,6 +2167,10 @@
     T1_Release_Table( &loader->swap_table );
     T1_Release_Table( &loader->subrs );
 
+    /* finalize hash */
+    ft_hash_num_free( loader->subrs_hash, memory );
+    FT_FREE( loader->subrs_hash );
+
     /* finalize parser */
     T1_Finalize_Parser( parser );
   }
@@ -2189,11 +2287,15 @@
 
     if ( loader.subrs.init )
     {
-      loader.subrs.init  = 0;
       type1->num_subrs   = loader.num_subrs;
       type1->subrs_block = loader.subrs.block;
       type1->subrs       = loader.subrs.elements;
       type1->subrs_len   = loader.subrs.lengths;
+      type1->subrs_hash  = loader.subrs_hash;
+
+      /* prevent `t1_done_loader' from freeing the propagated data */
+      loader.subrs.init = 0;
+      loader.subrs_hash = NULL;
     }
 
     if ( !IS_INCREMENTAL )
@@ -2212,8 +2314,8 @@
     /* the `lengths' field must be released later             */
     type1->glyph_names_block    = loader.glyph_names.block;
     type1->glyph_names          = (FT_String**)loader.glyph_names.elements;
-    loader.glyph_names.block    = 0;
-    loader.glyph_names.elements = 0;
+    loader.glyph_names.block    = NULL;
+    loader.glyph_names.elements = NULL;
 
     /* we must now build type1.encoding when we have a custom array */
     if ( type1->encoding_type == T1_ENCODING_TYPE_ARRAY )
diff --git a/freetype/src/type1/t1load.h b/freetype/src/type1/t1load.h
index 546fc3353..b96fe5a74 100644
--- a/freetype/src/type1/t1load.h
+++ b/freetype/src/type1/t1load.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 font loader (specification).                                  */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2004, 2006, 2007 by                         */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1LOAD_H__
-#define __T1LOAD_H__
+#ifndef T1LOAD_H_
+#define T1LOAD_H_
 
 
 #include <ft2build.h>
@@ -46,6 +46,7 @@ FT_BEGIN_HEADER
 
     FT_Int        num_subrs;
     PS_TableRec   subrs;
+    FT_Hash       subrs_hash;
     FT_Bool       fontdata;
 
     FT_UInt       keywords_encountered; /* T1_LOADER_ENCOUNTERED_XXX */
@@ -96,7 +97,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1LOAD_H__ */
+#endif /* T1LOAD_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1objs.c b/freetype/src/type1/t1objs.c
index e11770fee..a00911713 100644
--- a/freetype/src/type1/t1objs.c
+++ b/freetype/src/type1/t1objs.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 objects manager (body).                                       */
 /*                                                                         */
-/*  Copyright 1996-2009, 2011, 2013 by                                     */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -67,7 +67,7 @@
                             "pshinter" );
     return ( module && pshinter && pshinter->get_globals_funcs )
            ? pshinter->get_globals_funcs( module )
-           : 0 ;
+           : 0;
   }
 
 
@@ -86,7 +86,7 @@
       if ( funcs )
         funcs->destroy( (PSH_Globals)size->root.internal );
 
-      size->root.internal = 0;
+      size->root.internal = NULL;
     }
   }
 
@@ -144,7 +144,7 @@
   FT_LOCAL_DEF( void )
   T1_GlyphSlot_Done( FT_GlyphSlot  slot )
   {
-    slot->internal->glyph_hints = 0;
+    slot->internal->glyph_hints = NULL;
   }
 
 
@@ -224,7 +224,7 @@
     }
 
     T1_Done_Blend( face );
-    face->blend = 0;
+    face->blend = NULL;
 #endif
 
     /* release font info strings */
@@ -247,6 +247,9 @@
     FT_FREE( type1->subrs );
     FT_FREE( type1->subrs_len );
 
+    ft_hash_num_free( type1->subrs_hash, memory );
+    FT_FREE( type1->subrs_hash );
+
     FT_FREE( type1->subrs_block );
     FT_FREE( type1->charstrings_block );
     FT_FREE( type1->glyph_names_block );
@@ -345,7 +348,7 @@
       goto Exit;
 
     /* check the face index */
-    if ( face_index > 0 )
+    if ( ( face_index & 0xFFFF ) > 0 )
     {
       FT_ERROR(( "T1_Face_Init: invalid face index\n" ));
       error = FT_THROW( Invalid_Argument );
@@ -375,9 +378,6 @@
       if ( face->blend )
         root->face_flags |= FT_FACE_FLAG_MULTIPLE_MASTERS;
 
-      /* XXX: TODO -- add kerning with .afm support */
-
-
       /* The following code to extract the family and the style is very   */
       /* simplistic and might get some things wrong.  For a full-featured */
       /* algorithm you might have a look at the whitepaper given at       */
@@ -457,7 +457,7 @@
 
       /* no embedded bitmap support */
       root->num_fixed_sizes = 0;
-      root->available_sizes = 0;
+      root->available_sizes = NULL;
 
       root->bbox.xMin =   type1->font_bbox.xMin            >> 16;
       root->bbox.yMin =   type1->font_bbox.yMin            >> 16;
diff --git a/freetype/src/type1/t1objs.h b/freetype/src/type1/t1objs.h
index 54ccbb996..94fbdee9a 100644
--- a/freetype/src/type1/t1objs.h
+++ b/freetype/src/type1/t1objs.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 objects manager (specification).                              */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2006, 2011 by                               */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1OBJS_H__
-#define __T1OBJS_H__
+#ifndef T1OBJS_H_
+#define T1OBJS_H_
 
 
 #include <ft2build.h>
@@ -154,7 +154,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1OBJS_H__ */
+#endif /* T1OBJS_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1parse.c b/freetype/src/type1/t1parse.c
index ccf9f4cc5..563d9f37b 100644
--- a/freetype/src/type1/t1parse.c
+++ b/freetype/src/type1/t1parse.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 parser (body).                                                */
 /*                                                                         */
-/*  Copyright 1996-2005, 2008, 2009, 2012-2014 by                          */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -143,13 +143,13 @@
     FT_ULong   size;
 
 
-    psaux->ps_parser_funcs->init( &parser->root, 0, 0, memory );
+    psaux->ps_parser_funcs->init( &parser->root, NULL, NULL, memory );
 
     parser->stream       = stream;
     parser->base_len     = 0;
-    parser->base_dict    = 0;
+    parser->base_dict    = NULL;
     parser->private_len  = 0;
-    parser->private_dict = 0;
+    parser->private_dict = NULL;
     parser->in_pfb       = 0;
     parser->in_memory    = 0;
     parser->single_block = 0;
@@ -273,7 +273,7 @@
       /* made of several segments.  We thus first read the number of   */
       /* segments to compute the total size of the private dictionary  */
       /* then re-read them into memory.                                */
-      FT_Long    start_pos = FT_STREAM_POS();
+      FT_ULong   start_pos = FT_STREAM_POS();
       FT_UShort  tag;
 
 
@@ -334,7 +334,6 @@
       /* first of all, look at the `eexec' keyword */
       FT_Byte*    cur   = parser->base_dict;
       FT_Byte*    limit = cur + parser->base_len;
-      FT_Byte     c;
       FT_Pointer  pos_lf;
       FT_Bool     test_cr;
 
@@ -342,9 +341,9 @@
     Again:
       for (;;)
       {
-        c = cur[0];
-        if ( c == 'e' && cur + 9 < limit )  /* 9 = 5 letters for `eexec' + */
-                                            /* whitespace + 4 chars        */
+        if ( cur[0] == 'e'   &&
+             cur + 9 < limit )      /* 9 = 5 letters for `eexec' + */
+                                    /* whitespace + 4 chars        */
         {
           if ( cur[1] == 'e' &&
                cur[2] == 'x' &&
@@ -374,8 +373,15 @@
 
       while ( cur < limit )
       {
-        if ( *cur == 'e' && ft_strncmp( (char*)cur, "eexec", 5 ) == 0 )
-          goto Found;
+        if ( cur[0] == 'e'   &&
+             cur + 5 < limit )
+        {
+          if ( cur[1] == 'e' &&
+               cur[2] == 'x' &&
+               cur[3] == 'e' &&
+               cur[4] == 'c' )
+            goto Found;
+        }
 
         T1_Skip_PS_Token( parser );
         if ( parser->root.error )
@@ -389,6 +395,15 @@
 
       cur   = limit;
       limit = parser->base_dict + parser->base_len;
+
+      if ( cur >= limit )
+      {
+        FT_ERROR(( "T1_Get_Private_Dict:"
+                   " premature end in private dictionary\n" ));
+        error = FT_THROW( Invalid_File_Format );
+        goto Exit;
+      }
+
       goto Again;
 
       /* now determine where to write the _encrypted_ binary private  */
@@ -411,9 +426,11 @@
       /* fine that are violating this limitation, so we add a heuristic  */
       /* test to stop at \r only if it is not used for EOL.              */
 
-      pos_lf  = ft_memchr( cur, '\n', limit - cur );
-      test_cr = FT_BOOL( !pos_lf                                      ||
-                         pos_lf > ft_memchr( cur, '\r', limit - cur ) );
+      pos_lf  = ft_memchr( cur, '\n', (size_t)( limit - cur ) );
+      test_cr = FT_BOOL( !pos_lf                                       ||
+                         pos_lf > ft_memchr( cur,
+                                             '\r',
+                                             (size_t)( limit - cur ) ) );
 
       while ( cur < limit                    &&
               ( *cur == ' '                ||
@@ -429,7 +446,7 @@
         goto Exit;
       }
 
-      size = (FT_ULong)( parser->base_len - ( cur - parser->base_dict ) );
+      size = parser->base_len - (FT_ULong)( cur - parser->base_dict );
 
       if ( parser->in_memory )
       {
@@ -443,7 +460,7 @@
         parser->single_block = 1;
         parser->private_dict = parser->base_dict;
         parser->private_len  = size;
-        parser->base_dict    = 0;
+        parser->base_dict    = NULL;
         parser->base_len     = 0;
       }
 
@@ -459,7 +476,7 @@
            ft_isxdigit( cur[2] ) && ft_isxdigit( cur[3] ) )
       {
         /* ASCII hexadecimal encoding */
-        FT_Long  len;
+        FT_ULong  len;
 
 
         parser->root.cursor = cur;
diff --git a/freetype/src/type1/t1parse.h b/freetype/src/type1/t1parse.h
index fb1c8a883..affa818e6 100644
--- a/freetype/src/type1/t1parse.h
+++ b/freetype/src/type1/t1parse.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 parser (specification).                                       */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2008 by                               */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
@@ -16,8 +16,8 @@
 /***************************************************************************/
 
 
-#ifndef __T1PARSE_H__
-#define __T1PARSE_H__
+#ifndef T1PARSE_H_
+#define T1PARSE_H_
 
 
 #include <ft2build.h>
@@ -77,12 +77,6 @@ FT_BEGIN_HEADER
 
 
 #define T1_Add_Table( p, i, o, l )  (p)->funcs.add( (p), i, o, l )
-#define T1_Done_Table( p )          \
-          do                        \
-          {                         \
-            if ( (p)->funcs.done )  \
-              (p)->funcs.done( p ); \
-          } while ( 0 )
 #define T1_Release_Table( p )          \
           do                           \
           {                            \
@@ -129,7 +123,7 @@ FT_BEGIN_HEADER
 
 FT_END_HEADER
 
-#endif /* __T1PARSE_H__ */
+#endif /* T1PARSE_H_ */
 
 
 /* END */
diff --git a/freetype/src/type1/t1tokens.h b/freetype/src/type1/t1tokens.h
index e37276b90..a84f291a6 100644
--- a/freetype/src/type1/t1tokens.h
+++ b/freetype/src/type1/t1tokens.h
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    Type 1 tokenizer (specification).                                    */
 /*                                                                         */
-/*  Copyright 1996-2001, 2002, 2003, 2004, 2006, 2008, 2009 by             */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */
diff --git a/freetype/src/type1/type1.c b/freetype/src/type1/type1.c
index ccc12be10..bb8aca97f 100644
--- a/freetype/src/type1/type1.c
+++ b/freetype/src/type1/type1.c
@@ -4,7 +4,7 @@
 /*                                                                         */
 /*    FreeType Type 1 driver component (body only).                        */
 /*                                                                         */
-/*  Copyright 1996-2001 by                                                 */
+/*  Copyright 1996-2016 by                                                 */
 /*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
 /*                                                                         */
 /*  This file is part of the FreeType project, and may only be used,       */