From 8d3ba6df605efdea5673e713c84439f626ba7ae7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:26:01 +0000 Subject: [PATCH 1/3] Initial plan From ce931d8b113fd1b64773c3afb382a910ba8fb153 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:32:14 +0000 Subject: [PATCH 2/3] Fix STAT format 4 parsing pointer advance --- kitty/font-names.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kitty/font-names.c b/kitty/font-names.c index 0c55be344..2c03677c2 100644 --- a/kitty/font-names.c +++ b/kitty/font-names.c @@ -273,11 +273,14 @@ read_STAT_font_table(const uint8_t *table, size_t table_len, PyObject *name_look app("sd sd", "value", value, "linked_value", linked_value); } break; case 4: if ((uint8_t*)(p) + 6 * axis_index <= table_limit) { - RAII_PyObject(values, PyTuple_New(axis_index)); + const uint16_t axis_count = axis_index; + RAII_PyObject(values, PyTuple_New(axis_count)); if (!values) return false; - for (uint16_t n = 0; n < axis_index; n++, p += 3) { + for (uint16_t n = 0; n < axis_count; n++) { uint16_t actual_axis_index = next; - p32 = (uint32_t*)p; double value = next32; + p32 = (uint32_t*)p; + double value = next32; + p = (uint16_t*)p32; PyObject *e = Py_BuildValue("{sH sd}", "design_index", actual_axis_index, "value", value); if (!e) return false; PyTuple_SET_ITEM(values, n, e); From d5037b5beddcade81331d288215d44f7f628ec49 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 23 Jun 2026 16:35:35 +0000 Subject: [PATCH 3/3] Tighten STAT format 4 value parsing --- kitty/font-names.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/kitty/font-names.c b/kitty/font-names.c index 2c03677c2..f482a18b9 100644 --- a/kitty/font-names.c +++ b/kitty/font-names.c @@ -278,9 +278,8 @@ read_STAT_font_table(const uint8_t *table, size_t table_len, PyObject *name_look if (!values) return false; for (uint16_t n = 0; n < axis_count; n++) { uint16_t actual_axis_index = next; - p32 = (uint32_t*)p; - double value = next32; - p = (uint16_t*)p32; + double value = load_fixed((uint32_t*)p); + p += 2; PyObject *e = Py_BuildValue("{sH sd}", "design_index", actual_axis_index, "value", value); if (!e) return false; PyTuple_SET_ITEM(values, n, e);