libxfont: Changes to 'upstream-unstable'
configure.ac | 5 ----
doc/fontlib.xml | 5 +++-
src/FreeType/ftfuncs.c | 20 ++++++++---------
src/FreeType/xttcap.c | 2 -
src/bitmap/bdfread.c | 6 ++---
src/bitmap/bdfutils.c | 4 +--
src/bitmap/bitscale.c | 4 +++
src/bitmap/pcfread.c | 1
src/fc/fserve.c | 8 ++----
src/stubs/stubs.h | 57 ++++++++++++++++++++-----------------------------
src/util/fontxlfd.c | 10 ++++----
11 files changed, 57 insertions(+), 65 deletions(-)
New commits:
commit 8cce9834b2e74dccad94ca0adf79ae5585e37d48
Author: Adam Jackson <ajax@redhat.com>
Date: Wed Aug 31 16:19:11 2016 -0400
libXfont 1.5.2
Signed-off-by: Adam Jackson <ajax@redhat.com>
diff --git a/configure.ac b/configure.ac
index 640cc92..3325aa3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -21,7 +21,7 @@
# Initialize Autoconf
AC_PREREQ([2.60])
-AC_INIT([libXfont], [1.5.1],
+AC_INIT([libXfont], [1.5.2],
[https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXfont])
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_HEADERS([config.h include/X11/fonts/fontconf.h])
commit 42d85d1293b2753f3f200de0e960bacef0c973c7
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Mon May 30 00:46:21 2016 -0700
fserve: Fix a buffer read overrun in _fs_client_access
https://bugs.freedesktop.org/show_bug.cgi?id=83224
Found by clang's Address Sanitizer
crac.num_auths = set_font_authorizations(&authorizations, &authlen,
client);
/* Work around bug in xfs versions up through modular release 1.0.8
which rejects CreateAC packets with num_auths = 0 & authlen < 4 */
if (crac.num_auths == 0) {
authorizations = padding;
authlen = 4;
} else {
authlen = (authlen + 3) & ~0x3;
}
crac.length = (sizeof (fsCreateACReq) + authlen) >> 2;
crac.acid = cur->acid;
_fs_add_req_log(conn, FS_CreateAC);
_fs_write(conn, (char *) &crac, sizeof (fsCreateACReq));
_fs_write(conn, authorizations, authlen);
In the case in the report, set_font_authorizations setup authorizations as a
34 byte buffer (and authlen set to 34 as one would expect). The following
block changed authlen to 36 to make it 4byte aligned and the final _fs_write()
caused us to read 36 bytes from this 34 byte buffer.
This changes the incorrect size increase to instead use _fs_write_pad which
takes care of the padding for us.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
(cherry picked from commit 6972ea08ee5b2ef1cfbdc2fcaf14f06bbd391561)
diff --git a/src/fc/fserve.c b/src/fc/fserve.c
index bbaa8bf..4fb5551 100644
--- a/src/fc/fserve.c
+++ b/src/fc/fserve.c
@@ -2850,14 +2850,12 @@ _fs_client_access (FSFpePtr conn, pointer client, Bool sync)
if (crac.num_auths == 0) {
authorizations = padding;
authlen = 4;
- } else {
- authlen = (authlen + 3) & ~0x3;
}
crac.length = (sizeof (fsCreateACReq) + authlen) >> 2;
crac.acid = cur->acid;
_fs_add_req_log(conn, FS_CreateAC);
_fs_write(conn, (char *) &crac, sizeof (fsCreateACReq));
- _fs_write(conn, authorizations, authlen);
+ _fs_write_pad(conn, authorizations, authlen);
/* ignore reply; we don't even care about it */
conn->curacid = 0;
cur->auth_generation = client_auth_generation(client);
commit 2b09a7af9f19db886567e524f978ad393593f7c0
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Sun May 29 23:37:13 2016 -0700
fserve: Silence a -Wformat warning
src/fc/fserve.c:653:32: warning: format specifies type 'int' but the argument has type 'CARD32' (aka 'unsigned long') [-Wformat]
" from font server\n", rep->length);
^~~~~~~~~~~
1 warning generated.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
(cherry picked from commit e6009adbc89ec3e1f924bcb57b333c1c02f5e66d)
diff --git a/src/fc/fserve.c b/src/fc/fserve.c
index 92b0d53..bbaa8bf 100644
--- a/src/fc/fserve.c
+++ b/src/fc/fserve.c
@@ -631,8 +631,8 @@ fs_get_reply (FSFpePtr conn, int *error)
*/
if (rep->length > MAX_REPLY_LENGTH)
{
- ErrorF("fserve: reply length %d > MAX_REPLY_LENGTH, disconnecting"
- " from font server\n", rep->length);
+ ErrorF("fserve: reply length %ld > MAX_REPLY_LENGTH, disconnecting"
+ " from font server\n", (long)rep->length);
_fs_connection_died (conn);
*error = FSIO_ERROR;
return 0;
commit 3eddbca2690381bbbaf14adadb2679eea702095f
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Sun May 29 23:34:35 2016 -0700
bitmap: Bail out on invalid input to FontFileMakeDir instead of calling calloc for 0 bytes
Found by clang static analysis:
Call to 'calloc' has an allocation size of 0 bytes
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
(cherry picked from commit ac559fad20bbae45332c758abb6a790c3fd341a2)
diff --git a/src/bitmap/bitscale.c b/src/bitmap/bitscale.c
index c9af4c0..13ed924 100644
--- a/src/bitmap/bitscale.c
+++ b/src/bitmap/bitscale.c
@@ -1479,6 +1479,10 @@ BitmapScaleBitmaps(FontPtr pf, /* scaled font */
lastRow = pfi->lastRow;
nchars = (lastRow - firstRow + 1) * (lastCol - firstCol + 1);
+ if (nchars <= 0) {
+ goto bail;
+ }
+
glyph = pf->glyph;
for (i = 0; i < nchars; i++)
{
commit dfa572ea522a3019e91f2de7854b252c629342f2
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Sun May 29 23:29:50 2016 -0700
FreeType: Correct an allocation size
Found by clang static analysis:
Result of 'calloc' is converted to a pointer of type 'int', which is
incompatible with sizeof operand type 'int *'
This is likely benign because the old size was larger on any platform where
sizeof(int) <= sizeof(void *), which is everywhere.
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
(cherry picked from commit d0fff111992fed9d9bfbf0c19e136bda9ba1db55)
diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c
index df64f5e..703353d 100644
--- a/src/FreeType/ftfuncs.c
+++ b/src/FreeType/ftfuncs.c
@@ -622,7 +622,7 @@ FreeTypeInstanceFindGlyph(unsigned idx_in, int flags, FTInstancePtr instance,
offset = idx - segment * FONTSEGMENTSIZE;
if((*available)[segment] == NULL) {
- (*available)[segment] = calloc(FONTSEGMENTSIZE, sizeof(int *));
+ (*available)[segment] = calloc(FONTSEGMENTSIZE, sizeof(int));
if((*available)[segment] == NULL)
return AllocError;
}
commit bee4a764ccef46101dca03c70d4ad1793a5a5d78
Author: Keith Packard <keithp@keithp.com>
Date: Mon Dec 7 15:46:13 2015 -0800
Fix warnings
Mostly signed vs unsigned comparisons
Signed-off-by: Keith Packard <keithp@keithp.com>
Squashed commit of three cherry-picks from master:
(cherry picked from commit eb67d10ae82b364a4324e96ce53baaa4e5e75f97)
(cherry picked from commit eefc0b0b908eb8533e704d7156ce983ad7891cc5)
(cherry picked from commit d967caa988eaabd9e84c82879e2f21bd33b952a7)
diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c
index c440fde..df64f5e 100644
--- a/src/FreeType/ftfuncs.c
+++ b/src/FreeType/ftfuncs.c
@@ -474,7 +474,7 @@ FreeTypeOpenInstance(FTInstancePtr *instance_return, FTFacePtr face,
if( FT_IS_SFNT( face->face ) ) {
#if 1
FT_F26Dot6 tt_char_width, tt_char_height, tt_dim_x, tt_dim_y;
- FT_UInt nn;
+ FT_Int nn;
instance->strike_index=0xFFFFU;
@@ -1454,7 +1454,7 @@ FreeTypeRasteriseGlyph(unsigned idx, int flags, CharInfoPtr tgp,
}
for( i = MAX(0, dy) ; i<ht ; i++ ){
int prev_jj,jj;
- if( bitmap->rows <= i-dy ) break;
+ if( bitmap->rows <= (unsigned) (i-dy) ) break;
current_buffer=(unsigned char *)(bitmap->buffer+bitmap->pitch*(i-dy));
current_raster=(unsigned char *)(raster+i*bpr);
j = MAX(0,div_dx);
@@ -2985,13 +2985,13 @@ ft_compute_bounds(FTFontPtr font, FontInfoPtr pinfo, FontScalablePtr vals )
c = row<<8|col;
flags=0;
if ( !force_c_outside ) {
- if ( c <= instance->ttcap.forceConstantSpacingEnd
- && instance->ttcap.forceConstantSpacingBegin <= c )
+ if ( (signed) c <= instance->ttcap.forceConstantSpacingEnd
+ && instance->ttcap.forceConstantSpacingBegin <= (signed) c )
flags|=FT_FORCE_CONSTANT_SPACING;
}
else { /* for GB18030 proportional */
- if ( c <= instance->ttcap.forceConstantSpacingEnd
- || instance->ttcap.forceConstantSpacingBegin <= c )
+ if ( (signed) c <= instance->ttcap.forceConstantSpacingEnd
+ || instance->ttcap.forceConstantSpacingBegin <= (signed) c )
flags|=FT_FORCE_CONSTANT_SPACING;
}
#if 0
diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c
index eccd7b7..f343eed 100644
--- a/src/bitmap/bdfread.c
+++ b/src/bitmap/bdfread.c
@@ -298,7 +298,7 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
bdfError("invalid number of CHARS in BDF file\n");
return (FALSE);
}
- if (nchars > INT32_MAX / sizeof(CharInfoRec)) {
+ if (nchars > (signed) (INT32_MAX / sizeof(CharInfoRec))) {
bdfError("Couldn't allocate pCI (%d*%d)\n", nchars,
(int) sizeof(CharInfoRec));
goto BAILOUT;
@@ -631,7 +631,7 @@ bdfReadProperties(FontFilePtr file, FontPtr pFont, bdfFileState *pState)
}
if ((sscanf((char *) line, "STARTPROPERTIES %d", &nProps) != 1) ||
(nProps <= 0) ||
- (nProps > ((INT32_MAX / sizeof(FontPropRec)) - BDF_GENPROPS))) {
+ (nProps > (signed) ((INT32_MAX / sizeof(FontPropRec)) - BDF_GENPROPS))) {
bdfError("bad 'STARTPROPERTIES'\n");
return (FALSE);
}
diff --git a/src/bitmap/pcfread.c b/src/bitmap/pcfread.c
index 34eeeb7..33871ae 100644
--- a/src/bitmap/pcfread.c
+++ b/src/bitmap/pcfread.c
@@ -487,7 +487,6 @@ pcfReadFont(FontPtr pFont, FontFilePtr file,
for (i = 0; i < GLYPHPADOPTIONS; i++) {
bitmapSizes[i] = pcfGetINT32(file, format);
if (IS_EOF(file)) goto Bail;
- if (bitmapSizes[i] < 0) goto Bail;
}
sizebitmaps = bitmapSizes[PCF_GLYPH_PAD_INDEX(format)];
commit d6877a7c1c35985f6a75b6cd4e814595e781adc4
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Wed Oct 21 21:03:00 2015 -0700
Use NO_WEAK_SYMBOLS instead of -flat_namespace
Lesser of two evil hacks, I suppose...
This reverts commit 0386fa77367a305deea3cc27f8a3865cc3c467c0.
diff --git a/configure.ac b/configure.ac
index 7cb6bdf..640cc92 100644
--- a/configure.ac
+++ b/configure.ac
@@ -213,9 +213,6 @@ case $host_os in
linux*)
OS_CFLAGS="-D_XOPEN_SOURCE"
;;
- darwin*)
- OS_CFLAGS="-Wl,-flat_namespace"
- ;;
*)
OS_CFLAGS=
;;
diff --git a/src/stubs/stubs.h b/src/stubs/stubs.h
index c09c675..9e71806 100644
--- a/src/stubs/stubs.h
+++ b/src/stubs/stubs.h
@@ -10,7 +10,7 @@
#endif
/* this probably works for Mach-O too, but probably not for PE */
-#if (defined(__APPLE__) || defined(__ELF__)) && defined(__GNUC__) && (__GNUC__ >= 3)
+#if defined(__ELF__) && defined(__GNUC__) && (__GNUC__ >= 3)
#define weak __attribute__((weak))
#else
#define weak
@@ -67,15 +67,6 @@ extern void (*__register_fpe_functions)(void);
#define OVERRIDE_VA_SYMBOL(sym,f)
#endif
-/* This is really just a hack for now... __APPLE__ really should be using
- * the weak symbols route above, but it's causing an as-yet unresolved issue,
- * so we're instead building with flat_namespace.
- */
-#ifdef __APPLE__
-#undef weak
-#define weak
-#endif
-
extern FontPtr find_old_font ( FSID id );
extern int set_font_authorizations ( char **authorizations,
int *authlen,
commit 2788c6984bc54bfba61b2dbdb5353978199d8a37
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date: Wed Oct 21 21:27:26 2015 -0700
stubs: Add missing externs for declarations in the NO_WEAK_SYMBOLS && PIC stubs resolution
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
diff --git a/src/stubs/stubs.h b/src/stubs/stubs.h
index 7d499d5..c09c675 100644
--- a/src/stubs/stubs.h
+++ b/src/stubs/stubs.h
@@ -38,29 +38,29 @@ extern int _font_init_stubs(void);
(*__##sym)(f, _args); \
va_end(_args)
-int (*__client_auth_generation)(ClientPtr);
-Bool (*__ClientSignal)(ClientPtr);
-void (*__DeleteFontClientID)(Font);
-void (*__VErrorF)(const char *, va_list);
-FontPtr (*__find_old_font)(FSID);
-FontResolutionPtr (*__GetClientResolutions)(int *);
-int (*__GetDefaultPointSize)(void);
-Font (*__GetNewFontClientID)(void);
-unsigned long (*__GetTimeInMillis)(void);
-int (*__init_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr);
-int (*__RegisterFPEFunctions)(NameCheckFunc, InitFpeFunc, FreeFpeFunc,
- ResetFpeFunc, OpenFontFunc, CloseFontFunc, ListFontsFunc,
- StartLfwiFunc, NextLfwiFunc, WakeupFpeFunc, ClientDiedFunc,
- LoadGlyphsFunc, StartLaFunc, NextLaFunc, SetPathFunc);
-void (*__remove_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr, Bool);
-void **__ptr_serverClient;
-int (*__set_font_authorizations)(char **, int *, ClientPtr);
-int (*__StoreFontClientFont)(FontPtr, Font);
-Atom (*__MakeAtom)(const char *, unsigned, int);
-int (*__ValidAtom)(Atom);
-char *(*__NameForAtom)(Atom);
-unsigned long *__ptr_serverGeneration;
-void (*__register_fpe_functions)(void);
+extern int (*__client_auth_generation)(ClientPtr);
+extern Bool (*__ClientSignal)(ClientPtr);
+extern void (*__DeleteFontClientID)(Font);
+extern void (*__VErrorF)(const char *, va_list);
+extern FontPtr (*__find_old_font)(FSID);
+extern FontResolutionPtr (*__GetClientResolutions)(int *);
+extern int (*__GetDefaultPointSize)(void);
+extern Font (*__GetNewFontClientID)(void);
+extern unsigned long (*__GetTimeInMillis)(void);
+extern int (*__init_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr);
+extern int (*__RegisterFPEFunctions)(NameCheckFunc, InitFpeFunc, FreeFpeFunc,
+ ResetFpeFunc, OpenFontFunc, CloseFontFunc, ListFontsFunc,
+ StartLfwiFunc, NextLfwiFunc, WakeupFpeFunc, ClientDiedFunc,
+ LoadGlyphsFunc, StartLaFunc, NextLaFunc, SetPathFunc);
+extern void (*__remove_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr, Bool);
+extern void **__ptr_serverClient;
+extern int (*__set_font_authorizations)(char **, int *, ClientPtr);
+extern int (*__StoreFontClientFont)(FontPtr, Font);
+extern Atom (*__MakeAtom)(const char *, unsigned, int);
+extern int (*__ValidAtom)(Atom);
+extern char *(*__NameForAtom)(Atom);
+extern unsigned long *__ptr_serverGeneration;
+extern void (*__register_fpe_functions)(void);
#else /* NO_WEAK_SYMBOLS && PIC */
#define OVERRIDE_DATA(sym)
#define OVERRIDE_SYMBOL(sym,...)
commit d66f107d6e714a54515f39d94caf46aef9be7416
Author: Thomas Klausner <wiz@NetBSD.org>
Date: Wed Feb 25 21:45:50 2015 +0100
Fix is*() usage.
The argument must be an unsigned char or -1; in these cases
we know it's not -1 so cast it to unsigned char.
Fixes
warning: array subscript is of type 'char' [-Wchar-subscripts]
Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c
index a4969d1..c440fde 100644
--- a/src/FreeType/ftfuncs.c
+++ b/src/FreeType/ftfuncs.c
@@ -2061,7 +2061,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol,
long val;
/* skip comma and/or space */
- while (',' == *p || isspace(*p))
+ while (',' == *p || isspace((unsigned char)*p))
p++;
/* begin point */
@@ -2079,7 +2079,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol,
}
/* skip space */
- while (isspace(*p))
+ while (isspace((unsigned char)*p))
p++;
if (',' != *p && '\0' != *p) {
@@ -2092,7 +2092,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol,
break;
/* skip space */
- while (isspace(*p))
+ while (isspace((unsigned char)*p))
p++;
val = strtol(p, (char **)&q, 0);
diff --git a/src/FreeType/xttcap.c b/src/FreeType/xttcap.c
index cee752e..e30e0f9 100644
--- a/src/FreeType/xttcap.c
+++ b/src/FreeType/xttcap.c
@@ -632,7 +632,7 @@ SPropRecValList_add_by_font_cap(SDynPropRecValList *pThisList,
}
break;
}
- if ( !isdigit(*p) )
+ if ( !isdigit((unsigned char)*p) )
break;
}
}
diff --git a/src/bitmap/bdfutils.c b/src/bitmap/bdfutils.c
index 288148b..438d197 100644
--- a/src/bitmap/bdfutils.c
+++ b/src/bitmap/bdfutils.c
@@ -207,11 +207,11 @@ bdfIsInteger(char *str)
char c;
c = *str++;
- if (!(isdigit(c) || c == '-' || c == '+'))
+ if (!(isdigit((unsigned char)c) || c == '-' || c == '+'))
return (FALSE);
while ((c = *str++))
- if (!isdigit(c))
+ if (!isdigit((unsigned char)c))
return (FALSE);
return (TRUE);
diff --git a/src/util/fontxlfd.c b/src/util/fontxlfd.c
index 974128e..99a3679 100644
--- a/src/util/fontxlfd.c
+++ b/src/util/fontxlfd.c
@@ -145,9 +145,9 @@ xlfd_double_to_text(double value, char *buffer, int space_required)
if (value == 0.0) exponent = 0;
/* Figure out how many digits are significant */
- while (p1 >= buffer && (!isdigit(*p1) || *p1 == '0')) p1--;
+ while (p1 >= buffer && (!isdigit((unsigned char)*p1) || *p1 == '0')) p1--;
ndigits = 0;
- while (p1 >= buffer) if (isdigit(*p1--)) ndigits++;
+ while (p1 >= buffer) if (isdigit((unsigned char)*p1--)) ndigits++;
/* Figure out notation to use */
if (exponent >= XLFD_NDIGITS || ndigits - exponent > XLFD_NDIGITS + 1)
@@ -278,7 +278,7 @@ GetMatrix(char *ptr, FontScalablePtr vals, int which)
matrix = vals->point_matrix;
else return (char *)0;
- while (isspace(*ptr)) ptr++;
+ while (isspace((unsigned char)*ptr)) ptr++;
if (*ptr == '[')
{
/* This is a matrix containing real numbers. It would be nice
@@ -292,13 +292,13 @@ GetMatrix(char *ptr, FontScalablePtr vals, int which)
(ptr = readreal(ptr, matrix + 2)) &&
(ptr = readreal(ptr, matrix + 3)))
{
- while (isspace(*ptr)) ptr++;
+ while (isspace((unsigned char)*ptr)) ptr++;
if (*ptr != ']')
ptr = (char *)0;
else
{
ptr++;
- while (isspace(*ptr)) ptr++;
+ while (isspace((unsigned char)*ptr)) ptr++;
if (*ptr == '-')
{
if (which == POINTSIZE_MASK)
commit 1a73d6828dfa03924f2d68644fb5b99afd9c78e2
Author: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Date: Mon Jul 13 14:43:06 2015 -0400
bdfReadCharacters: Allow negative DWIDTH values
The fix for CVE-2015-1804 prevent DWIDTH to be negative.
However, the spec states that "DWIDTH [...] is a vector indicating the
position of the next glyph’s origin relative to the origin of this glyph."
So negative values are correct.
Found by trying to compile XTS.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c
index a0ace8f..eccd7b7 100644
--- a/src/bitmap/bdfread.c
+++ b/src/bitmap/bdfread.c
@@ -426,7 +426,7 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
goto BAILOUT;
}
/* xCharInfo metrics are stored as INT16 */
- if ((wx < 0) || (wx > INT16_MAX)) {
+ if ((wx < INT16_MIN) || (wx > INT16_MAX)) {
bdfError("character '%s' has out of range width, %d\n",
charName, wx);
goto BAILOUT;
commit 159bfa4ec094e7d342c9b59c31bfea7dccbac58a
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Feb 7 17:24:48 2015 -0800
doc: add a couple olinks to fsproto & xfs-design docs
Don't seem to have ability to link to BDF or Xserver internals docs yet
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
diff --git a/doc/fontlib.xml b/doc/fontlib.xml
index c5079c8..ce31bb5 100644
--- a/doc/fontlib.xml
+++ b/doc/fontlib.xml
@@ -111,8 +111,9 @@
</listitem>
<listitem>
<para>
+ <olink targetdoc='xfs-design' targetptr='xfs-design'>
<citetitle pubwork="article">Font Server Implementation
- Overview</citetitle> which discusses the design of the font
+ Overview</citetitle></olink> which discusses the design of the font
server.
</para>
</listitem>
@@ -126,7 +127,9 @@
</listitem>
<listitem>
<para>
+ <olink targetdoc='fsproto' targetptr='fsproto'>
<citetitle pubwork="article">The X Font Service Protocol</citetitle>
+ </olink>
for a description of the constraints placed on the design by
including support for this font service mechanism.
</para>
Reply to: