[truetype] tt_size_reset_height to take FT_Size

The `MetricsVariations` `FT_Size_Reset_Func` is defined to take an
`FT_Size`. Because `tt_size_reset_height` is to be used as such a
function, it must also take an `FT_Size` instead of a `TT_Size`. Even
though the pointers passed will be the same at runtime, calling a
function through a pointer of a different type from the original
function pointer type is undefined behavior. This may be caught at
runtime by Control Flow Integrity with something like clang's
`cfi-icall`.

Issue: https://crbug.com/1433651

* src/truetype/ttobjs.h (tt_size_reset_height): take `FT_Size`

* src/truetype/ttobjs.c (tt_size_reset_height): take `FT_Size` and
update documentation

2 files changed, 9 insertions, 5 deletions

diff --git a/src/truetype/ttobjs.c b/src/truetype/ttobjs.c
index ee4f3de1b..c351e082b 100644
--- a/src/truetype/ttobjs.c
+++ b/src/truetype/ttobjs.c
@@ -1346,12 +1346,16 @@
    *   Used for variation fonts as an iterator function.
    *
    * @Input:
-   *   size ::
-   *     A handle to the target size object.
+   *   ft_size ::
+   *     A handle to the target TT_Size object. This function will be called
+   *     through a `FT_Size_Reset_Func` pointer which takes `FT_Size`. This
+   *     function must take `FT_Size` as a result. The passed `FT_Size` is
+   *     expected to point to a `TT_Size`.
    */
   FT_LOCAL_DEF( FT_Error )
-  tt_size_reset_height( TT_Size  size )
+  tt_size_reset_height( FT_Size  ft_size )
   {
+    TT_Size           size         = (TT_Size)ft_size;
     TT_Face           face         = (TT_Face)size->root.face;
     FT_Size_Metrics*  size_metrics = &size->hinted_metrics;
 
@@ -1408,7 +1412,7 @@
     FT_Size_Metrics*  size_metrics = &size->hinted_metrics;
 
 
-    error = tt_size_reset_height( size );
+    error = tt_size_reset_height( (FT_Size)size );
     if ( error )
       return error;
 
diff --git a/src/truetype/ttobjs.h b/src/truetype/ttobjs.h
index d74264e57..d1834c046 100644
--- a/src/truetype/ttobjs.h
+++ b/src/truetype/ttobjs.h
@@ -391,7 +391,7 @@ FT_BEGIN_HEADER
 #endif /* TT_USE_BYTECODE_INTERPRETER */
 
   FT_LOCAL( FT_Error )
-  tt_size_reset_height( TT_Size  size );
+  tt_size_reset_height( FT_Size  size );
 
   FT_LOCAL( FT_Error )
   tt_size_reset( TT_Size  size );