*** xc.420/extras/X-TrueType/xttfuncs.c	2001-12-18 13:23:55.000000000 +0900
--- xc/extras/X-TrueType/xttfuncs.c	2003-02-18 03:20:32.000000000 +0900
***************
*** 566,572 ****
      /*
       * Check invalid char index.
       */
!     if ( c <= 0 ) {
          charInfo = &nocharinfo;
          goto next;
      }
--- 566,572 ----
      /*
       * Check invalid char index.
       */
!     if ( c < 0 ) {
          charInfo = &nocharinfo;
          goto next;
      }
***************
*** 770,776 ****
      /*
       * Check invalid char index.
       */
!     if ( c <= 0 ) {
          charInfo = &nocharinfo;
          goto next;
      }
--- 770,776 ----
      /*
       * Check invalid char index.
       */
!     if ( c < 0 ) {
          charInfo = &nocharinfo;
          goto next;
      }
***************
*** 850,856 ****
  
          ft->map.rows  = height;
          bytes = (width + 7) / 8;
!         /* aligenment */
          bytes = (bytes + (glyph) - 1) & -glyph;
          ft->map.cols  = bytes;
          ft->map.width = width;
--- 850,856 ----
  
          ft->map.rows  = height;
          bytes = (width + 7) / 8;
!         /* alignment */
          bytes = (bytes + (glyph) - 1) & -glyph;
          ft->map.cols  = bytes;
          ft->map.width = width;
***************
*** 862,867 ****
--- 862,868 ----
              goto next;
          }
          ft->map.bitmap = charInfo->bits;
+         if ( ft->map.bitmap == NULL ) goto next;
  
          /*
           * draw a sbit or an outline glyph
***************
*** 898,903 ****
--- 899,905 ----
      CharInfoPtr *glyphsBase = glyphs;
  
      int spacing = 0;
+     int i,nullbits,ncmark;
  
      dprintf((stderr, "FreeTypeGetGlyphs: %p %d\n", pFont, count));
  
***************
*** 913,952 ****
          break;
      }
  
!     switch (encoding) {
!     case Linear8Bit:
!     case TwoD8Bit:
!         while (count--) {
!             unsigned c = *chars++;
!             c = ft->codeConverterInfo.ptrCodeConverter(c);
!             dprintf((stderr, "%04x\n", c));
!             *glyphs++ = get_glyph(ft, TT_Char_Index(ft->charmap, c), spacing);
!         }
!         break;
!     case Linear16Bit:
!     case TwoD16Bit:
!         while (count--) {
!             unsigned c1, c2;
              c1 = *chars++;
              c2 = *chars++;
!             dprintf((stderr, "code: %02x%02x ->", c1,c2));
!             if (!(c1 >= pFont->info.firstRow &&
!                   c1 <= pFont->info.lastRow  &&
!                   c2 >= pFont->info.firstCol &&
!                   c2 <= pFont->info.lastCol)) {
!                 *glyphs++ = &nocharinfo;
!                 dprintf((stderr, "invalid code\n"));
              } else {
!                 c1 = ft->codeConverterInfo.ptrCodeConverter(c1<<8|c2);
!                 dprintf((stderr, "%04x\n", c1));
!                 *glyphs++ = get_glyph(ft, TT_Char_Index(ft->charmap, c1),
!                                       spacing);
              }
          }
!         break;
      }
  
      *pCount = glyphs - glyphsBase;
      return Successful;
  }
  
--- 915,1015 ----
          break;
      }
  
!     while (count--) {
!         unsigned int c1=0, c2;
! 
!         *glyphs = &nocharinfo;
!         switch (encoding) {
!         case Linear8Bit:
!         case TwoD8Bit:
!             c1 = *chars++;
!             dprintf((stderr, "%04x\n", c1));
!             break;
!         case Linear16Bit:
!         case TwoD16Bit:
              c1 = *chars++;
              c2 = *chars++;
!             dprintf((stderr, "code: %02x%02x", c1,c2));
!             if (c1 >= pFont->info.firstRow &&
!                 c1 <= pFont->info.lastRow  &&
!                 c2 >= pFont->info.firstCol &&
!                 c2 <= pFont->info.lastCol) {
!                 c1 = (c1<<8|c2);
              } else {
!                 dprintf((stderr, ", out of range.  We use nocharinfo.\n"));
!                 *glyphs = &nocharinfo;
!                 goto next;
              }
+             break;
+         default:
+             goto next;
          }
! 
!         c1 = ft->codeConverterInfo.ptrCodeConverter(c1);
!         dprintf((stderr, " ->%04x\n ->", c1));
!         c1 = TT_Char_Index(ft->charmap, c1);
!         dprintf((stderr, "%d\n", c1));
!         *glyphs = get_glyph(ft, c1, spacing);
! 
!     next:
! #if 1
!         /* fallback for XAA */
!         if ( *glyphs == &nocharinfo ) {
!             dprintf((stderr, "nocharinfo causes a server crash. Instead We use .notdef glyph.\n"));
!             *glyphs = get_glyph(ft, 0, spacing);
!         }
! #endif
!         glyphs++;
      }
  
      *pCount = glyphs - glyphsBase;
+ 
+     /*
+       (pci)->bits == NULL crashes the Server when gHeight is not zero.
+       So we must check each value of (pci)->bits.  Since operation of
+       cash intervenes,  this "for () loop"  *MUST*  be independent of
+       the upper "while () loop".
+                                         Dec.26,2002  Chisato Yamauchi
+      */
+     dprintf((stderr, "AddressCheckBegin *pCount=%d\n",*pCount));
+     nullbits=0;
+     ncmark=-1;
+     for ( i=0 ; i<*pCount ; i++ ) {
+       /* Marking nocharinfo */
+       if ( glyphsBase[i] == &nocharinfo ) {
+         if ( ncmark == -1 ) ncmark=i;
+       }
+       else {
+         dprintf((stderr,"[%d]:%x\n",i,glyphsBase[i]->bits));
+         if ( glyphsBase[i]->bits == NULL ) {
+             glyphsBase[i]->metrics.ascent=0;
+             glyphsBase[i]->metrics.descent=0;
+             nullbits++;
+         }
+         /*
+           The XFree86 sometimes allocates memory with the value of maxbounds.ascent
+           and maxbounds.descent. 
+           So (*glyphs)->ascent must not become larger than maxbounds.ascent.
+           This is the same also about descent.
+          */
+         if ( pFont->info.maxbounds.ascent < glyphsBase[i]->metrics.ascent ) {
+             dprintf((stderr, " Invalid ascent : maxbounds.ascent=%d metrics.ascent=%d [corrected]\n",
+                      pFont->info.maxbounds.ascent,glyphsBase[i]->metrics.ascent));
+             glyphsBase[i]->metrics.ascent = pFont->info.maxbounds.ascent;
+         }
+         if ( pFont->info.maxbounds.descent < glyphsBase[i]->metrics.descent ) {
+             dprintf((stderr, " Invalid descent : maxbounds.descent=%d metrics.descent=%d [corrected]\n",
+                      pFont->info.maxbounds.descent,glyphsBase[i]->metrics.descent));
+             glyphsBase[i]->metrics.descent = pFont->info.maxbounds.descent;
+         }
+       }
+     }
+ #if 1
+     /* Never return an address outside cache(for XAA). */
+     if ( ncmark != -1 ) *pCount = ncmark;
+ #endif
+     dprintf((stderr, "AddressCheckEnd i=%d nullbits=%d\n",i,nullbits));
+ 
      return Successful;
  }
  
***************
*** 960,966 ****
  {
      FreeTypeFont *ft = (FreeTypeFont*) pFont->fontPrivate;
      xCharInfo **glyphsBase = glyphs;
!     unsigned int c;
  
      /*dprintf((stderr, "FreeTypeGetMetrics: %d\n", count));*/
      if (ft->spacing == 'm' || ft->spacing == 'p') {
--- 1023,1030 ----
  {
      FreeTypeFont *ft = (FreeTypeFont*) pFont->fontPrivate;
      xCharInfo **glyphsBase = glyphs;
!     unsigned int c=0,c2;
!     int i;
  
      /*dprintf((stderr, "FreeTypeGetMetrics: %d\n", count));*/
      if (ft->spacing == 'm' || ft->spacing == 'p') {
***************
*** 972,1004 ****
          } else
              char_width.pixel = char_width.raw = 0;
  
!         switch (encoding) {
!         case Linear8Bit:
!         case TwoD8Bit:
!             while (count--) {
                  c = *chars++;
! /*              dprintf((stderr, "code: %04x ->", c));*/
!                 c = ft->codeConverterInfo.ptrCodeConverter(c);
! /*              dprintf((stderr, "%04x\n", c));*/
!                 *glyphs++ =
!                     get_metrics(ft, TT_Char_Index(ft->charmap, c),
!                                 char_width);
              }
!             break;
!         case Linear16Bit:
!         case TwoD16Bit:
!             while (count--) {
!                 c = *chars++ << 8; c |= *chars++;
! /*              dprintf((stderr, "code: %04x ->", c));*/
!                 c = ft->codeConverterInfo.ptrCodeConverter(c);
! /*              dprintf((stderr, "%04x\n", c));*/
!                 *glyphs++ =
!                     get_metrics(ft, TT_Char_Index(ft->charmap, c),
!                                 char_width);
              }
!             break;
          }
          *pCount = glyphs - glyphsBase;
      } else {                                    /* -c- */
          switch (encoding) {
          case Linear8Bit:
--- 1036,1099 ----
          } else
              char_width.pixel = char_width.raw = 0;
  
!         while (count--) {
!             *glyphs = &(&nocharinfo)->metrics;
!             switch (encoding) {
!             case Linear8Bit:
!             case TwoD8Bit:
                  c = *chars++;
!                 break;
!             case Linear16Bit:
!             case TwoD16Bit:
!                 c  = *chars++;
!                 c2 = *chars++;
!                 if (c  >= pFont->info.firstRow &&
!                     c  <= pFont->info.lastRow  &&
!                     c2 >= pFont->info.firstCol &&
!                     c2 <= pFont->info.lastCol) {
!                     c  = (c<<8|c2);
!                 } else {
!                     *glyphs = &(&nocharinfo)->metrics;
!                     goto next;
!                 }
!                 break;
!             default:
!                 goto next;
              }
!             /* dprintf((stderr, "code: %04x ->", c));*/
!             c = ft->codeConverterInfo.ptrCodeConverter(c);
!             /* dprintf((stderr, "%04x\n", c));*/
!             *glyphs = get_metrics(ft, TT_Char_Index(ft->charmap, c),
!                                   char_width);
!     next:
! #if 1
!             /* fallback */
!             if ( *glyphs == &(&nocharinfo)->metrics ) {
!                 dprintf((stderr, "nocharinfo -> Instead We use .notdef glyph.\n"));
!                 *glyphs = get_metrics(ft, 0, char_width);
              }
! #endif
!             glyphs++;
          }
          *pCount = glyphs - glyphsBase;
+         /*
+           The XFree86 sometimes allocates memory with the value of maxbounds.ascent
+           and maxbounds.descent. 
+           So (*glyphs)->ascent must not become larger than maxbounds.ascent.
+           This is the same also about descent.
+          */
+         for ( i=0 ; i<*pCount ; i++ ) {
+             if ( pFont->info.maxbounds.ascent < glyphsBase[i]->ascent ) {
+                 dprintf((stderr, " Invalid ascent : maxbounds.ascent=%d metrics.ascent=%d [corrected]\n",
+                          pFont->info.maxbounds.ascent,glyphsBase[i]->ascent));
+                 glyphsBase[i]->ascent = pFont->info.maxbounds.ascent;
+             }
+             if ( pFont->info.maxbounds.descent < glyphsBase[i]->descent ) {
+                 dprintf((stderr, " Invalid descent : maxbounds.descent=%d metrics.descent=%d [corrected]\n",
+                          pFont->info.maxbounds.descent,glyphsBase[i]->descent));
+                 glyphsBase[i]->descent = pFont->info.maxbounds.descent;
+             }
+         }
      } else {                                    /* -c- */
          switch (encoding) {
          case Linear8Bit:
***************
*** 1100,1106 ****
                                  char_width);
                  }
  
!             if (!tmpchar->characterWidth)
                  continue;
  
                  adjust_min_max(&minchar, &maxchar, tmpchar);
--- 1195,1201 ----
                                  char_width);
                  }
  
!             if (!tmpchar || !tmpchar->characterWidth)
                  continue;
  
                  adjust_min_max(&minchar, &maxchar, tmpchar);
*** xc.420/extras/X-TrueType/xttcconv.c	2001-03-07 03:54:39.000000000 +0900
--- xc/extras/X-TrueType/xttcconv.c	2003-02-27 18:29:14.000000000 +0900
***************
*** 510,523 ****
              {
                  char **l;
  		char **tryItFirst = NULL;
  
!                 for (l=list; *l ; l++) {
! 			if(!mystrcasecmp(*l,moduleArg.charSetHints->charsetStdName)) {
! 				tryItFirst = l;
! 				break;
! 			}
! 		}
! 
  		if(tryItFirst)
  			l = tryItFirst;
  		else
--- 510,549 ----
              {
                  char **l;
  		char **tryItFirst = NULL;
+         char **fallback_try = NULL;
  
!         for (l=list; *l ; l++) {
!             int breaking=0;
!             char *tmp_left=NULL;
!             char *mark_underscore=NULL;
!             tmp_left=xstrdup(*l);
!             mark_underscore=strrchr(tmp_left,'_');
!             if( mark_underscore != NULL ){
!                 *mark_underscore = '\0';
!                 if( !mystrcasecmp(tmp_left,moduleArg.charSetHints->charsetStdName) ){
!                     if( !mystrcasecmp( mark_underscore+1,moduleArg.charSetHints->charsetEncoding ) ){
!                         tryItFirst = l;
!                         breaking=1;
!                     }
!                 }
!             }
!             else{
!                 if(!mystrcasecmp(*l,moduleArg.charSetHints->charsetStdName)) {
!                     tryItFirst = l;
!                     breaking=1;
!                 }
!             }
!             if( fallback_try == NULL ){
!                 if( !mystrcasecmp(*l,"ISO8859_1") ){
!                     fallback_try = l;
!                 }
!             }
!             if( tmp_left ) xfree(tmp_left);
!             if( breaking ) break;
!         }
! #if 1
!         if( tryItFirst == NULL ) tryItFirst=fallback_try;
! #endif
  		if(tryItFirst)
  			l = tryItFirst;
  		else