|
 |
43e195 |
From 3788187e0c396952cd7d905c6c61f3ff8e84b2b4 Mon Sep 17 00:00:00 2001
|
|
|
43e195 |
From: Werner Lemberg <wl@gnu.org>
|
|
|
43e195 |
Date: Sat, 22 Nov 2014 09:46:47 +0000
|
|
|
43e195 |
Subject: [type42] Fix Savannah bug #43659.
|
|
|
43e195 |
|
|
|
43e195 |
* src/type42/t42objs.c (T42_Open_Face): Initialize `face->ttf_size'.
|
|
|
43e195 |
|
|
|
43e195 |
* src/type42/t42parse.c (t42_parse_sfnts): Always set
|
|
|
43e195 |
`face->ttf_size' directly. This ensures a correct stream size in
|
|
|
43e195 |
the call to `FT_Open_Face', which follows after parsing, even for
|
|
|
43e195 |
buggy input data.
|
|
|
43e195 |
Fix error messages.
|
|
|
43e195 |
---
|
|
|
43e195 |
diff --git a/src/type42/t42objs.c b/src/type42/t42objs.c
|
|
|
43e195 |
index 798ebdb..7a9cb57 100644
|
|
|
43e195 |
--- a/src/type42/t42objs.c
|
|
|
43e195 |
+++ b/src/type42/t42objs.c
|
|
|
43e195 |
@@ -47,6 +47,12 @@
|
|
|
43e195 |
if ( FT_ALLOC( face->ttf_data, 12 ) )
|
|
|
43e195 |
goto Exit;
|
|
|
43e195 |
|
|
|
43e195 |
+ /* while parsing the font we always update `face->ttf_size' so that */
|
|
|
43e195 |
+ /* even in case of buggy data (which might lead to premature end of */
|
|
|
43e195 |
+ /* scanning without causing an error) the call to `FT_Open_Face' in */
|
|
|
43e195 |
+ /* `T42_Face_Init' passes the correct size */
|
|
|
43e195 |
+ face->ttf_size = 12;
|
|
|
43e195 |
+
|
|
|
43e195 |
error = t42_parser_init( parser,
|
|
|
43e195 |
face->root.stream,
|
|
|
43e195 |
memory,
|
|
|
43e195 |
diff --git a/src/type42/t42parse.c b/src/type42/t42parse.c
|
|
|
43e195 |
index a60e216..daf304d 100644
|
|
|
43e195 |
--- a/src/type42/t42parse.c
|
|
|
43e195 |
+++ b/src/type42/t42parse.c
|
|
|
43e195 |
@@ -498,7 +498,7 @@
|
|
|
43e195 |
FT_Byte* limit = parser->root.limit;
|
|
|
43e195 |
FT_Error error;
|
|
|
43e195 |
FT_Int num_tables = 0;
|
|
|
43e195 |
- FT_ULong count, ttf_size = 0;
|
|
|
43e195 |
+ FT_ULong count;
|
|
|
43e195 |
|
|
|
43e195 |
FT_Long n, string_size, old_string_size, real_size;
|
|
|
43e195 |
FT_Byte* string_buf = NULL;
|
|
|
43e195 |
@@ -591,7 +591,7 @@
|
|
|
43e195 |
|
|
|
43e195 |
if ( limit - parser->root.cursor < string_size )
|
|
|
43e195 |
{
|
|
|
43e195 |
- FT_ERROR(( "t42_parse_sfnts: too many binary data\n" ));
|
|
|
43e195 |
+ FT_ERROR(( "t42_parse_sfnts: too much binary data\n" ));
|
|
|
43e195 |
error = T42_Err_Invalid_File_Format;
|
|
|
43e195 |
goto Fail;
|
|
|
43e195 |
}
|
|
|
43e195 |
@@ -631,18 +631,18 @@
|
|
|
43e195 |
}
|
|
|
43e195 |
else
|
|
|
43e195 |
{
|
|
|
43e195 |
- num_tables = 16 * face->ttf_data[4] + face->ttf_data[5];
|
|
|
43e195 |
- status = BEFORE_TABLE_DIR;
|
|
|
43e195 |
- ttf_size = 12 + 16 * num_tables;
|
|
|
43e195 |
+ num_tables = 16 * face->ttf_data[4] + face->ttf_data[5];
|
|
|
43e195 |
+ status = BEFORE_TABLE_DIR;
|
|
|
43e195 |
+ face->ttf_size = 12 + 16 * num_tables;
|
|
|
43e195 |
|
|
|
43e195 |
- if ( FT_REALLOC( face->ttf_data, 12, ttf_size ) )
|
|
|
43e195 |
+ if ( FT_REALLOC( face->ttf_data, 12, face->ttf_size ) )
|
|
|
43e195 |
goto Fail;
|
|
|
43e195 |
}
|
|
|
43e195 |
/* fall through */
|
|
|
43e195 |
|
|
|
43e195 |
case BEFORE_TABLE_DIR:
|
|
|
43e195 |
/* the offset table is read; read the table directory */
|
|
|
43e195 |
- if ( count < ttf_size )
|
|
|
43e195 |
+ if ( count < face->ttf_size )
|
|
|
43e195 |
{
|
|
|
43e195 |
face->ttf_data[count++] = string_buf[n];
|
|
|
43e195 |
continue;
|
|
|
43e195 |
@@ -661,24 +661,23 @@
|
|
|
43e195 |
len = FT_PEEK_ULONG( p );
|
|
|
43e195 |
|
|
|
43e195 |
/* Pad to a 4-byte boundary length */
|
|
|
43e195 |
- ttf_size += ( len + 3 ) & ~3;
|
|
|
43e195 |
+ face->ttf_size += ( len + 3 ) & ~3;
|
|
|
43e195 |
}
|
|
|
43e195 |
|
|
|
43e195 |
- status = OTHER_TABLES;
|
|
|
43e195 |
- face->ttf_size = ttf_size;
|
|
|
43e195 |
+ status = OTHER_TABLES;
|
|
|
43e195 |
|
|
|
43e195 |
/* there are no more than 256 tables, so no size check here */
|
|
|
43e195 |
if ( FT_REALLOC( face->ttf_data, 12 + 16 * num_tables,
|
|
|
43e195 |
- ttf_size + 1 ) )
|
|
|
43e195 |
+ face->ttf_size + 1 ) )
|
|
|
43e195 |
goto Fail;
|
|
|
43e195 |
}
|
|
|
43e195 |
/* fall through */
|
|
|
43e195 |
|
|
|
43e195 |
case OTHER_TABLES:
|
|
|
43e195 |
/* all other tables are just copied */
|
|
|
43e195 |
- if ( count >= ttf_size )
|
|
|
43e195 |
+ if ( count >= face->ttf_size )
|
|
|
43e195 |
{
|
|
|
43e195 |
- FT_ERROR(( "t42_parse_sfnts: too many binary data\n" ));
|
|
|
43e195 |
+ FT_ERROR(( "t42_parse_sfnts: too much binary data\n" ));
|
|
|
43e195 |
error = T42_Err_Invalid_File_Format;
|
|
|
43e195 |
goto Fail;
|
|
|
43e195 |
}
|
|
|
43e195 |
--
|
|
|
43e195 |
cgit v0.9.0.2
|