renderText: tests for damaged fonts, sbix, empty text and normalization

- tests/fonts/sbix.py builds sbix.ttf (a PNG with an origin offset, and
  a 'dupe' of it); the bitmap and its placement are checked
- empty text renders a pixel wide, combining sequences like the composed
  characters
- damaged fonts (truncated, bytes changed, and the damaged Noto-COLRv1
  subset that ran out of memory before) render or throw a font error
  within 3 seconds
- changelog entries for sbix, normalization and the robustness fixes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJgRK5qpwJEbHPuFv6kgAQ

Author: matmen

CHANGELOG.md

@@ -19,7 +19,8 @@
   about 2.5 steps. `fast: false` keeps the precise sampling.
 - `Image.renderText` takes several fonts by priority (`[text, emoji]`): every character comes from the first font that
   has it, the first font sets the line height. Color glyphs keep their colors: COLR version 0 layers with CPAL
-  palettes (e.g. Twemoji) and CBDT/CBLC bitmaps (e.g. Noto Color Emoji, which now loads at all, it has no outlines).
+  palettes (e.g. Twemoji), CBDT/CBLC bitmaps (e.g. Noto Color Emoji, which now loads at all, it has no outlines) and
+  sbix bitmaps (Apple's format).
   Invisible characters like joiners and variation selectors take no room, as in browsers.
 - `Image.renderText` applies the fonts' glyph substitutions (GSUB) that browsers apply by default (`ccmp`, `rlig`,
   `liga`, `clig`, `calt`): emoji sequences (skin tones, flags, keycaps, families and other joined ones) become one
@@ -30,6 +31,8 @@
   gradients (pad, repeat, reflect), glyph outlines as masks, transforms and all composite modes; variable paints with
   their default values. They are rendered at four times the size and scaled down, so layers sharing an edge don't let the
   ones below show through. Fonts with both prefer them over their other color glyphs, like browsers.
+- `Image.renderText` composes combining sequences (e + ◌́ to é, as in text from macOS) where the font has the composed
+  character, and decomposes characters the fonts lack where one has their parts, like HarfBuzz.
 - Fallback fonts are only loaded when the text needs them, and glyphs (also decoded and scaled emoji bitmaps) are
   kept per font and size across calls.
 
@@ -45,6 +48,14 @@
   glyphs (opaque text renders as before).
 - The outline of `Image.renderText` follows the glyphs' antialiased edges instead of their pixels, so it is smooth
   rather than stepped, and it reaches exactly `strokeWidth` beyond the edge.
+- `Image.renderText` threw for text without anything to show (empty, only spaces), it now renders a transparent pixel
+  wide.
+- Damaged fonts no longer take unbounded memory or time: glyphs with contour end points that don't increase render
+  empty (as in FreeType), composite glyphs can't contain themselves (also when hinting), and outlines have a size
+  limit. Reading past the end of damaged or truncated font data throws "Font: damaged or truncated font data" instead
+  of a RangeError, and text larger than 2^28 pixels throws.
+- Glyph outlines reaching far outside their bitmap rasterize correctly (the parts outside used to change the slope of
+  the edges inside).
 
 ## 3.2.1
 

tests/font.js

@@ -3,8 +3,9 @@
  https://www.1001fonts.com/carbon-font.html
  https://www.1001fonts.com/ethnocentric-font.html
  https://github.com/adobe-fonts/source-sans (SIL OFL, see OFL-SourceSans3.md)
- https://github.com/googlefonts/noto-emoji (subsets of Noto Color Emoji and Noto-COLRv1, SIL OFL, see OFL-NotoColorEmoji.md)
- colrv1 paints.ttf is built by colrv1-paints.py
+ https://github.com/googlefonts/noto-emoji (subsets of Noto Color Emoji and Noto-COLRv1, SIL OFL, see OFL-NotoColorEmoji.md;
+   damaged noto colrv1 subset.ttf is a damaged copy for tests/regressions.js)
+ colrv1 paints.ttf is built by colrv1-paints.py, sbix.ttf by sbix.py
  https://github.com/mozilla/twemoji-colr (subset, CC-BY 4.0, see CC-BY-Twemoji.md)
  */
 
@@ -216,4 +217,26 @@ const panic = message => {
         const [fr, fg, fb, fa] = foreground.getRGBAAt(Math.round(foreground.width * 0.12), foreground.height >> 1);
         if (fr > 2 || Math.abs(fg - 0xaa) > 2 || Math.abs(fb - 0xaa) > 2 || fa < 253) panic(`colrv1: layers in the text color should take it (${fr},${fg},${fb},${fa})`);
     }
+
+    {
+        // sbix bitmaps: the PNG placed by its origin offset (8, -4 at 64 ppem), and a 'dupe' of it
+        const font = await fs.readFile('./tests/fonts/sbix.ttf');
+        const square = await Image.renderText(font, 64, '\ue000'), dupe = await Image.renderText(font, 64, '\ue001');
+        if (!Buffer.from(square.bitmap).equals(Buffer.from(dupe.bitmap))) panic('sbix: a dupe should render as the glyph it refers to');
+        // the baseline is at the ascender (0.9 em), the bitmap's bottom 4 pixels below it, its left edge at 8
+        const [r, g, b] = square.getRGBAAt(8 + 24, Math.ceil(0.9 * 64) + 4 - 24), [cr, , cb] = square.getRGBAAt(8 + 4, Math.ceil(0.9 * 64) + 4 - 44);
+        if (!(r > 200 && g < 50 && b < 50 && cb > 200 && cr < 50)) panic(`sbix: the bitmap should be placed by its origin offset (${r},${g},${b} / ${cr},${cb})`);
+        if (square.getRGBAAt(8 - 2, 30)[3] !== 0) panic('sbix: nothing left of the bitmap');
+    }
+
+    {
+        // text without anything to show renders a transparent pixel wide, it doesn't throw
+        const font = await fs.readFile('./tests/fonts/sourcesans3 regular.otf');
+        for (const text of ['', ' ', '\u200b\ufe0f'])
+            if ((await Image.renderText(font, 32, text)).width !== 1) panic(`empty text: ${JSON.stringify(text)} should render a pixel wide`);
+
+        // combining sequences are composed where the font has the composed character
+        const composed = await Image.renderText(font, 32, 'Café Müller'), decomposed = await Image.renderText(font, 32, 'Cafe\u0301 Mu\u0308ller');
+        if (!Buffer.from(composed.bitmap).equals(Buffer.from(decomposed.bitmap))) panic('combining sequences should render like the composed characters');
+    }
 })();

tests/fonts/damaged noto colrv1 subset.ttf

@@ -0,0 +1,30 @@
+# builds "sbix.ttf" (python sbix.py sbix.ttf, needs fontTools): an sbix test font, U+E000 a red square PNG with a blue
+# corner, U+E001 the same bitmap through a 'dupe' record, one strike at 64 ppem
+import sys, struct, zlib
+from fontTools.fontBuilder import FontBuilder
+from fontTools.pens.ttGlyphPen import TTGlyphPen
+from fontTools.ttLib import newTable
+from fontTools.ttLib.tables.sbixStrike import Strike
+from fontTools.ttLib.tables.sbixGlyph import Glyph as SbixGlyph
+
+def png(width, height, pixel):
+    rows = b''.join(b'\0' + b''.join(bytes(pixel(x, y)) for x in range(width)) for y in range(height))
+    chunk = lambda kind, data: struct.pack('>I', len(data)) + kind + data + struct.pack('>I', zlib.crc32(kind + data))
+    return b'\x89PNG\r\n\x1a\n' + chunk(b'IHDR', struct.pack('>IIBBBBB', width, height, 8, 6, 0, 0, 0)) + chunk(b'IDAT', zlib.compress(rows)) + chunk(b'IEND', b'')
+
+names = ['.notdef', 'square', 'dupe']
+fb = FontBuilder(1000, isTTF=True)
+fb.setupGlyphOrder(names)
+fb.setupCharacterMap({0xE000: 'square', 0xE001: 'dupe'})
+fb.setupGlyf({n: TTGlyphPen(None).glyph() for n in names})
+fb.setupHorizontalMetrics({n: (1000, 0) for n in names})
+fb.setupHorizontalHeader(ascent=900, descent=-100)
+fb.setupNameTable({'familyName': 'sbix Test', 'styleName': 'Regular'})
+fb.setupOS2(); fb.setupPost()
+image = png(48, 48, lambda x, y: (0, 0, 255, 255) if x < 12 and y < 12 else (255, 0, 0, 255))
+strike = Strike(ppem=64, resolution=72)
+strike.glyphs['square'] = SbixGlyph(glyphName='square', graphicType='png ', originOffsetX=8, originOffsetY=-4, imageData=image)
+strike.glyphs['dupe'] = SbixGlyph(glyphName='dupe', graphicType='dupe', referenceGlyphName='square')
+sbix = newTable('sbix'); sbix.version = 1; sbix.flags = 1; sbix.strikes = {64: strike}
+fb.font['sbix'] = sbix
+fb.save(sys.argv[1])

tests/fonts/sbix.py

@@ -532,4 +532,33 @@ const rgba = (image, x, y) => Image.colorToRGBA(image.getPixelAt(x, y));
             }
         assert(crc32(data) === zlib.crc32(data), 'crc32: wrong for a long buffer');
     }
+
+    // damaged fonts (truncated, bytes changed) render or throw a font error, quickly: no runaway memory or time (contours
+    // with decreasing end points, composite glyphs containing themselves, huge COLR clip boxes)
+    {
+        const fs = require('fs');
+        let seed = 7;
+        const random = () => (seed = Math.imul(seed, 1103515245) + 12345 >>> 0) / 2 ** 32;
+        // (a damaged copy of the Noto-COLRv1 subset with 3329 contours of decreasing end points in a glyph ran out of memory)
+        const start = Date.now();
+        await Image.renderText(fs.readFileSync('./tests/fonts/damaged noto colrv1 subset.ttf'), 40, '😀🔥👍❤️').catch(err => assert(/^Font: /.test(err.message), err.message));
+        assert(Date.now() - start < 3000, 'the damaged Noto-COLRv1 subset took too long');
+        for (const file of ['sourcesans3 regular.otf', 'opensans bold.ttf', 'noto colrv1 subset.ttf', 'noto color emoji subset.ttf']) {
+            const original = fs.readFileSync(`./tests/fonts/${file}`);
+            for (let k = 0; k < 30; k++) {
+                let data = original.subarray(0, Math.floor(random() * original.length));
+                if (k >= 10) {
+                    data = Buffer.from(original);
+                    for (let n = 0; n < 1 + random() * 20; n++) data[Math.floor(random() * data.length)] = random() * 256;
+                }
+                const start = Date.now();
+                try {
+                    await Image.renderText(data, 40, 'Hi office 😀🔥 👍🏽 🇩🇪 1️⃣ e\u0301');
+                } catch (err) {
+                    assert(/^Font: /.test(err.message), `${file} #${k}: unexpected error for a damaged font: ${err.message}`);
+                }
+                assert(Date.now() - start < 3000, `${file} #${k}: a damaged font took ${Date.now() - start} ms`);
+            }
+        }
+    }
 })();