Chiebot-Mirror
/
freetype
mirror of https://github.com/freetype/freetype.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

[cid] Add a bunch of safety checks.

Browse Source 
* src/cid/cidload.c (parse_fd_array): Check `num_dicts' against
stream size.
(cid_read_subrs): Check largest offset against stream size.
(cid_parse_dict): Move safety check to ...
(cid_face_open): ... this function.
Also test length of binary data and values of `SDBytes',
`SubrMapOffset', `SubrCount', `CIDMapOffset', and `CIDCount'.
2.6.5
Werner Lemberg 9 years ago
parent d47d372c96
commit 3eccc3a3f8
2 changed files with 132 additions and 23 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 12
      ChangeLog
  2. 143
      src/cid/cidload.c

12
ChangeLog
Unescape View File

@ -1,3 +1,15 @@
2015-10-20 Werner Lemberg <wl@gnu.org>
[cid] Add a bunch of safety checks.
* src/cid/cidload.c (parse_fd_array): Check `num_dicts' against
stream size.
(cid_read_subrs): Check largest offset against stream size.
(cid_parse_dict): Move safety check to ...
(cid_face_open): ... this function.
Also test length of binary data and values of `SDBytes',
`SubrMapOffset', `SubrCount', `CIDMapOffset', and `CIDCount'.
2015-10-20 Werner Lemberg <wl@gnu.org>
[cid] Avoid segfault with malformed input (#46250).

143
src/cid/cidload.c
Unescape View File

@ -215,6 +215,7 @@
{
CID_FaceInfo cid = &face->cid;
FT_Memory memory = face->root.memory;
FT_Stream stream = parser->stream;
FT_Error error = FT_Err_Ok;
FT_Long num_dicts;
@ -227,6 +228,31 @@
goto Exit;
}
/*
* A single entry in the FDArray must (at least) contain the following
* structure elements.
*
* %ADOBeginFontDict 18
* X dict begin 13
* /FontMatrix [X X X X] 22
* /Private X dict begin 22
* end 4
* end 4
* %ADOEndFontDict 16
*
* This needs 18+13+22+22+4+4+16=99 bytes or more. Normally, you also
* need a `dup X' at the very beginning and a `put' at the end, so a
* rough guess using 100 bytes as the minimum is justified.
*/
if ( (FT_ULong)num_dicts > stream->size / 100 )
{
FT_TRACE0(( "parse_fd_array: adjusting FDArray size"
" (from %d to %d)\n",
num_dicts,
stream->size / 100 ));
num_dicts = (FT_Long)( stream->size / 100 );
}
if ( !cid->font_dicts )
{
FT_Int n;
@ -401,16 +427,6 @@
FT_ERROR(( "cid_parse_dict: No font dictionary found\n" ));
return FT_THROW( Invalid_File_Format );
}
/* allow at most 32bit offsets */
if ( face->cid.fd_bytes > 4 || face->cid.gd_bytes > 4 )
{
FT_ERROR(( "cid_parse_dict:"
" Values of `FDBytes' or `GDBytes' larger than 4\n"
" "
" are not supported\n" ));
return FT_THROW( Invalid_File_Format );
}
}
return parser->root.error;
@ -445,13 +461,6 @@
FT_Byte* p;
/* Check for possible overflow. */
if ( num_subrs == FT_UINT_MAX )
{
error = FT_THROW( Syntax_Error );
goto Fail;
}
/* reallocate offsets array if needed */
if ( num_subrs + 1 > max_offsets )
{
@ -485,17 +494,24 @@
for ( count = 1; count <= num_subrs; count++ )
if ( offsets[count - 1] > offsets[count] )
{
FT_TRACE1(( "cid_read_subrs: offsets are not ordered\n" ));
error = FT_THROW( Syntax_Error );
FT_ERROR(( "cid_read_subrs: offsets are not ordered\n" ));
error = FT_THROW( Invalid_File_Format );
goto Fail;
}
if ( offsets[num_subrs] > stream->size - cid->data_offset )
{
FT_ERROR(( "cid_read_subrs: too large `subrs' offsets\n" ));
error = FT_THROW( Invalid_File_Format );
goto Fail;
}
/* now, compute the size of subrs charstrings, */
/* allocate, and read them */
data_len = offsets[num_subrs] - offsets[0];
if ( FT_NEW_ARRAY( subr->code, num_subrs + 1 ) ||
FT_ALLOC( subr->code[0], data_len ) )
FT_ALLOC( subr->code[0], data_len ) )
goto Fail;
if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) ||
@ -675,6 +691,12 @@
CID_Parser* parser;
FT_Memory memory = face->root.memory;
FT_Error error;
FT_Int n;
CID_FaceInfo cid = &face->cid;
FT_ULong binary_length;
FT_ULong entry_len;
cid_init_loader( &loader, face );
@ -699,6 +721,17 @@
if ( parser->binary_length )
{
if ( parser->binary_length >
face->root.stream->size - parser->data_offset )
{
FT_TRACE0(( "cid_face_open: adjusting length of binary data\n"
" (from %d to %d bytes)\n",
parser->binary_length,
face->root.stream->size - parser->data_offset ));
parser->binary_length = face->root.stream->size -
parser->data_offset;
}
/* we must convert the data section from hexadecimal to binary */
if ( FT_ALLOC( face->binary_data, parser->binary_length ) ||
cid_hex_to_binary( face->binary_data, parser->binary_length,
@ -707,14 +740,78 @@
FT_Stream_OpenMemory( face->cid_stream,
face->binary_data, parser->binary_length );
face->cid.data_offset = 0;
cid->data_offset = 0;
}
else
{
*face->cid_stream = *face->root.stream;
face->cid.data_offset = loader.parser.data_offset;
*face->cid_stream = *face->root.stream;
cid->data_offset = loader.parser.data_offset;
}
/* sanity tests */
/* allow at most 32bit offsets */
if ( cid->fd_bytes > 4 || cid->gd_bytes > 4 )
{
FT_ERROR(( "cid_parse_dict:"
" Values of `FDBytes' or `GDBytes' larger than 4\n"
" "
" are not supported\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
binary_length = face->cid_stream->size - cid->data_offset;
entry_len = (FT_ULong)( cid->fd_bytes + cid->gd_bytes );
for ( n = 0; n < cid->num_dicts; n++ )
{
CID_FaceDict dict = cid->font_dicts + n;
if ( dict->sd_bytes > 4 )
{
FT_ERROR(( "cid_parse_dict:"
" Values of `SDBytes' larger than 4"
" are not supported\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
if ( dict->subrmap_offset > binary_length )
{
FT_ERROR(( "cid_parse_dict: Invalid `SubrMapOffset' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
if ( dict->sd_bytes &&
dict->num_subrs >
( binary_length - dict->subrmap_offset ) / dict->sd_bytes )
{
FT_ERROR(( "cid_parse_dict: Invalid `SubrCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
}
if ( cid->cidmap_offset > binary_length )
{
FT_ERROR(( "cid_parse_dict: Invalid `CIDMapOffset' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
if ( entry_len &&
cid->cid_count >
( binary_length - cid->cidmap_offset ) / entry_len )
{
FT_ERROR(( "cid_parse_dict: Invalid `CIDCount' value\n" ));
error = FT_THROW( Invalid_File_Format );
goto Exit;
}
/* we can now safely proceed */
error = cid_read_subrs( face );
Exit:

Write Preview
Loading…
Cancel
Save