ReceiveTempSMS
/
Al-Qurtas-Islamic-bank-The-Best-Bank-in-Iraq
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avoid heap explosion in the case of malformed .Z font files 

related to bug #19910, but not a bugfix yet
This commit is contained in:
David Turner 2007-05-22 09:53:44 +00:00
parent 9df3c223f7
commit 0d0365ec59
3 changed files with 40 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,9 +1,15 @@
2007-06-20 Ismail Dönmez <ismail@pardus.org.tr> 2007-05-22 David Turner <david@freetype.org>
* src/lzw/ftzopen.h, src/lzw/ftzopen.c: apply some "band-aid"
to avoid blowing up the heap in the case of malformed fonts.
related to bug #19910; *not* a real fix though...
2007-05-20 Ismail Dönmez <ismail@pardus.org.tr>
* src/pshinter/pshrec.c (ps_mask_table_set_bits): Add `const'. * src/pshinter/pshrec.c (ps_mask_table_set_bits): Add `const'.
(ps_dimension_set_mask_bits): Remove `const'. (ps_dimension_set_mask_bits): Remove `const'.
2007-06-19 Werner Lemberg <wl@gnu.org> 2007-05-19 Werner Lemberg <wl@gnu.org>
* src/sfnt/ttmtx.c (tt_face_get_metrics) * src/sfnt/ttmtx.c (tt_face_get_metrics)
[!FT_CONFIG_OPTION_OLD_INTERNALS]: Another type-punning fix. [!FT_CONFIG_OPTION_OLD_INTERNALS]: Another type-punning fix.

49
src/lzw/ftzopen.c
View File

@ -87,6 +87,11 @@
FT_UInt old_size = state->stack_size; FT_UInt old_size = state->stack_size;
FT_UInt new_size = old_size; FT_UInt new_size = old_size;
/* limit stack size to detect invalid files */
/* the magic number comes from the origin NetBSD zopen implementation */
if (state->stack_size >= 69001 )
return -1;
new_size = new_size + ( new_size >> 1 ) + 4; new_size = new_size + ( new_size >> 1 ) + 4;
if ( state->stack == state->stack_0 ) if ( state->stack == state->stack_0 )
@ -110,6 +115,7 @@
{ {
FT_UInt old_size = state->prefix_size; FT_UInt old_size = state->prefix_size;
FT_UInt new_size = old_size; FT_UInt new_size = old_size;
FT_UInt max_size = INT_MAX/(sizeof(FT_UShort)+sizeof(FT_Byte));
FT_Memory memory = state->memory; FT_Memory memory = state->memory;
FT_Error error; FT_Error error;
@ -119,6 +125,13 @@
else else
new_size += new_size >> 2; /* don't grow too fast */ new_size += new_size >> 2; /* don't grow too fast */
if (new_size < old_size || new_size > max_size)
{
new_size = max_size;
if (new_size == old_size)
return -1;
}
/* /*
* Note that the `suffix' array is located in the same memory block * Note that the `suffix' array is located in the same memory block
* pointed to by `prefix'. * pointed to by `prefix'.
@ -213,11 +226,11 @@
{ {
FT_ULong result = 0; FT_ULong result = 0;
FT_UInt num_bits = state->num_bits; FT_UInt num_bits = state->num_bits;
FT_UInt free_ent = state->free_ent; FT_UInt free_ent = state->free_ent;
FT_UInt old_char = state->old_char; FT_UInt last_char = state->last_char;
FT_UInt old_code = state->old_code; FT_UInt old_code = state->old_code;
FT_UInt in_code = state->in_code; FT_UInt in_code = state->in_code;
if ( out_size == 0 ) if ( out_size == 0 )
@ -255,15 +268,15 @@
if ( c < 0 ) if ( c < 0 )
goto Eof; goto Eof;
old_code = old_char = (FT_UInt)c; old_code = last_char = (FT_UInt)c;
if ( buffer ) if ( buffer )
buffer[result] = (FT_Byte)old_char; buffer[result] = (FT_Byte)last_char;
state->phase = FT_LZW_PHASE_CODE;
if ( ++result >= out_size ) if ( ++result >= out_size )
goto Exit; goto Exit;
state->phase = FT_LZW_PHASE_CODE;
} }
/* fall-through */ /* fall-through */
@ -303,7 +316,7 @@
/* special case for KwKwKwK */ /* special case for KwKwKwK */
if ( code - 256U >= free_ent ) if ( code - 256U >= free_ent )
{ {
FTLZW_STACK_PUSH( old_char ); FTLZW_STACK_PUSH( last_char );
code = old_code; code = old_code;
} }
@ -314,8 +327,8 @@
} }
} }
old_char = code; last_char = code;
FTLZW_STACK_PUSH( old_char ); FTLZW_STACK_PUSH( last_char );
state->phase = FT_LZW_PHASE_STACK; state->phase = FT_LZW_PHASE_STACK;
} }
@ -344,7 +357,7 @@
FT_ASSERT( free_ent < state->prefix_size ); FT_ASSERT( free_ent < state->prefix_size );
state->prefix[free_ent] = (FT_UShort)old_code; state->prefix[free_ent] = (FT_UShort)old_code;
state->suffix[free_ent] = (FT_Byte) old_char; state->suffix[free_ent] = (FT_Byte) last_char;
if ( ++free_ent == state->free_bits ) if ( ++free_ent == state->free_bits )
{ {
@ -367,11 +380,11 @@
} }
Exit: Exit:
state->num_bits = num_bits; state->num_bits = num_bits;
state->free_ent = free_ent; state->free_ent = free_ent;
state->old_code = old_code; state->old_code = old_code;
state->old_char = old_char; state->last_char = last_char;
state->in_code = in_code; state->in_code = in_code;
return result; return result;

2
src/lzw/ftzopen.h
View File

@ -128,7 +128,7 @@
FT_UInt free_ent; /* index of next free entry */ FT_UInt free_ent; /* index of next free entry */
FT_UInt free_bits; /* if reached by free_ent, increment num_bits */ FT_UInt free_bits; /* if reached by free_ent, increment num_bits */
FT_UInt old_code; FT_UInt old_code;
FT_UInt old_char; FT_UInt last_char;
FT_UInt in_code; FT_UInt in_code;
FT_UShort* prefix; /* always dynamically allocated / reallocated */ FT_UShort* prefix; /* always dynamically allocated / reallocated */