minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

[sfnt, truetype] Don't abort on invalid `maxComponentDepth'. 

Since 2016-05-16 we detect infinite recursion directly.

* src/sfnt/ttload.c (tt_face_load_maxp): Don't adjust
`maxComponentDepth'.
* src/truetype/ttgload.c (load_truetype_glyph): Don't abort if
`maxComponentDepth' is not valid.  Instead, simply adjust its value
and emit a tracing message.
This commit is contained in:
Werner Lemberg 2016-07-29 06:43:32 +02:00
parent d9c7f5aa6e
commit fae4ec0525
3 changed files with 17 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ChangeLog
View File

@ -1,3 +1,15 @@
2016-07-29 Werner Lemberg <wl@gnu.org>
[sfnt, truetype] Don't abort on invalid `maxComponentDepth'.
Since 2016-05-16 we detect infinite recursion directly.
* src/sfnt/ttload.c (tt_face_load_maxp): Don't adjust
`maxComponentDepth'.
* src/truetype/ttgload.c (load_truetype_glyph): Don't abort if
`maxComponentDepth' is not valid. Instead, simply adjust its value
and emit a tracing message.
2016-07-26 Werner Lemberg <wl@gnu.org> 2016-07-26 Werner Lemberg <wl@gnu.org>
* src/autofit/aflatin.c (af_latin_metrics_scale_dim): Minor. * src/autofit/aflatin.c (af_latin_metrics_scale_dim): Minor.

9
src/sfnt/ttload.c
View File

@ -775,15 +775,6 @@
maxProfile->maxTwilightPoints = 0xFFFFU - 4; maxProfile->maxTwilightPoints = 0xFFFFU - 4;
} }
/* we arbitrarily limit recursion to avoid stack exhaustion */
if ( maxProfile->maxComponentDepth > 100 )
{
FT_TRACE0(( "tt_face_load_maxp:"
" abnormally large component depth (%d) set to 100\n",
maxProfile->maxComponentDepth ));
maxProfile->maxComponentDepth = 100;
}
} }
FT_TRACE3(( "numGlyphs: %u\n", maxProfile->numGlyphs )); FT_TRACE3(( "numGlyphs: %u\n", maxProfile->numGlyphs ));

11
src/truetype/ttgload.c
View File

@ -1436,13 +1436,12 @@
FT_TRACE5(( " nesting level: %d\n", recurse_count )); FT_TRACE5(( " nesting level: %d\n", recurse_count ));
#endif #endif
/* some fonts have an incorrect value of `maxComponentDepth', */ /* some fonts have an incorrect value of `maxComponentDepth' */
/* thus we allow depth 1 to catch the majority of them */ if ( recurse_count > face->max_profile.maxComponentDepth )
if ( recurse_count > 1 &&
recurse_count > face->max_profile.maxComponentDepth )
{ {
error = FT_THROW( Invalid_Composite ); FT_TRACE1(( "load_truetype_glyph: maxComponentDepth set to %d\n",
goto Exit; recurse_count ));
face->max_profile.maxComponentDepth = recurse_count;
} }
#ifndef FT_CONFIG_OPTION_INCREMENTAL #ifndef FT_CONFIG_OPTION_INCREMENTAL