commit 453316792fee912cfced48e9e270e9eb19892e64

Author: suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>

Date:   Wed Nov 26 16:02:17 2014 +0900

    * src/base/ftobjs.c (Mac_Read_POST_Resource): Use unsigned long

    variables to read the lengths in POST fragments.  Suggested by

    Mateusz Jurczyk <mjurczyk@google.com>.

diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c

index 922216e..dfad24a 100644

--- a/src/base/ftobjs.c

+++ b/src/base/ftobjs.c

@@ -1545,9 +1545,9 @@

     FT_Memory  memory = library->memory;

     FT_Byte*   pfb_data = NULL;

     int        i, type, flags;

-    FT_Long    len;

-    FT_Long    pfb_len, pfb_pos, pfb_lenpos;

-    FT_Long    rlen, temp;

+    FT_ULong   len;

+    FT_ULong   pfb_len, pfb_pos, pfb_lenpos;

+    FT_ULong   rlen, temp;

     if ( face_index == -1 )

@@ -1563,25 +1563,25 @@

       error = FT_Stream_Seek( stream, offsets[i] );

       if ( error )

         goto Exit;

-      if ( FT_READ_LONG( temp ) )

+      if ( FT_READ_ULONG( temp ) )

         goto Exit;

-      if ( 0 > temp )

+      FT_TRACE4(( "                 POST fragment #%d: length=0x%08x\n", i, temp));

+      if ( 0x7FFFFFFFUL < temp )

+      {

         error = FT_Err_Invalid_Offset;

-      else if ( 0x7FFFFFFFL - 6 - pfb_len < temp )

-        error = FT_Err_Array_Too_Large;

-

-      if ( error )

         goto Exit;

+      }

       pfb_len += temp + 6;

     }

-    if ( 0x7FFFFFFFL - 2 < pfb_len )

+    FT_TRACE2(( "             total buffer size to concatenate %d POST fragments: 0x%08x\n",

+                 resource_cnt, pfb_len + 2));

+    if ( pfb_len + 2 < 6 ) {

       error = FT_Err_Array_Too_Large;

-    else

-      error = FT_ALLOC( pfb_data, (FT_Long)pfb_len + 2 );

-

-    if ( error )

+      goto Exit;

+    }

+    if ( FT_ALLOC( pfb_data, (FT_Long)pfb_len + 2 ) )

       goto Exit;

     pfb_data[0] = 0x80;

@@ -1600,21 +1602,25 @@

       error = FT_Stream_Seek( stream, offsets[i] );

       if ( error )

         goto Exit2;

-      if ( FT_READ_LONG( rlen ) )

+      if ( FT_READ_ULONG( rlen ) )

         goto Exit;

-      if ( rlen < 0 )

+      if ( 0x7FFFFFFFUL < rlen )

       {

         error = FT_Err_Invalid_Offset;

         goto Exit2;

       }

       if ( FT_READ_USHORT( flags ) )

         goto Exit;

       FT_TRACE3(( "POST fragment[%d]: offsets=0x%08x, rlen=0x%08x, flags=0x%04x\n",

                    i, offsets[i], rlen, flags ));

+      error = FT_Err_Array_Too_Large;

       /* postpone the check of rlen longer than buffer until FT_Stream_Read() */

       if ( ( flags >> 8 ) == 0 )        /* Comment, should not be loaded */

+      {

+        FT_TRACE3(( "    Skip POST fragment #%d because it is a comment\n", i ));

         continue;

+      }

       /* the flags are part of the resource, so rlen >= 2.  */

       /* but some fonts declare rlen = 0 for empty fragment */

@@ -1624,16 +1632,10 @@

         rlen = 0;

       if ( ( flags >> 8 ) == type )

-      {

-        if ( 0x7FFFFFFFL - rlen < len )

-        {

-          error = FT_Err_Array_Too_Large;

-          goto Exit2;

-        }

         len += rlen;

-      }

       else

       {

+        FT_TRACE3(( "    Write POST fragment #%d header (4-byte) to buffer 0x%p + 0x%08x\n", i, pfb_data, pfb_lenpos ));

         if ( pfb_lenpos + 3 > pfb_len + 2 )

           goto Exit2;

         pfb_data[pfb_lenpos    ] = (FT_Byte)( len );

@@ -1644,6 +1646,7 @@

         if ( ( flags >> 8 ) == 5 )      /* End of font mark */

           break;

+        FT_TRACE3(( "    Write POST fragment #%d header (6-byte) to buffer 0x%p + 0x%08x\n", i, pfb_data, pfb_pos ));

         if ( pfb_pos + 6 > pfb_len + 2 )

           goto Exit2;

         pfb_data[pfb_pos++] = 0x80;

@@ -1659,21 +1662,17 @@

         pfb_data[pfb_pos++] = 0;

       }

-      error = FT_Err_Cannot_Open_Resource;

-      if ( rlen > 0x7FFFFFFFL - pfb_pos )

-      {

-        error = FT_Err_Array_Too_Large;

-        goto Exit2;

-      }

       if ( pfb_pos > pfb_len || pfb_pos + rlen > pfb_len )

         goto Exit2;

+      FT_TRACE3(( "    Load POST fragment #%d (%d byte) to buffer 0x%p + 0x%08x\n", i, rlen, pfb_data, pfb_pos ));

       error = FT_Stream_Read( stream, (FT_Byte *)pfb_data + pfb_pos, rlen );

       if ( error )

         goto Exit2;

       pfb_pos += rlen;

     }

+    error = FT_Err_Array_Too_Large;

     if ( pfb_pos + 2 > pfb_len + 2 )

       goto Exit2;

     pfb_data[pfb_pos++] = 0x80;

@@ -1694,6 +1693,12 @@

                                   aface );

   Exit2:

+    if ( error == FT_Err_Array_Too_Large )

+      FT_TRACE2(( "  Abort due to too-short buffer to store all POST fragments\n" ));

+    else if ( error == FT_Err_Invalid_Offset )

+      FT_TRACE2(( "  Abort due to invalid offset in a POST fragment\n" ));

+    if ( error )

+      error = FT_Err_Cannot_Open_Resource;

     FT_FREE( pfb_data );

   Exit: