|
 |
cf1e18 |
From 2f5e57317339c526e6eaee1010b0e2ab8089c42e Mon Sep 17 00:00:00 2001
|
|
|
cf1e18 |
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
cf1e18 |
Date: Fri, 25 Apr 2014 23:01:11 -0700
|
|
|
cf1e18 |
Subject: [PATCH 01/12] CVE-2014-0209: integer overflow of realloc() size in FontFileAddEntry()
|
|
|
cf1e18 |
MIME-Version: 1.0
|
|
|
cf1e18 |
Content-Type: text/plain; charset=UTF-8
|
|
|
cf1e18 |
Content-Transfer-Encoding: 8bit
|
|
|
cf1e18 |
|
|
|
cf1e18 |
FontFileReadDirectory() opens a fonts.dir file, and reads over every
|
|
|
cf1e18 |
line in an fscanf loop. For each successful entry read (font name,
|
|
|
cf1e18 |
file name) a call is made to FontFileAddFontFile().
|
|
|
cf1e18 |
|
|
|
cf1e18 |
FontFileAddFontFile() will add a font file entry (for the font name
|
|
|
cf1e18 |
and file) each time it’s called, by calling FontFileAddEntry().
|
|
|
cf1e18 |
FontFileAddEntry() will do the actual adding. If the table it has
|
|
|
cf1e18 |
to add to is full, it will do a realloc, adding 100 more entries
|
|
|
cf1e18 |
to the table size without checking to see if that will overflow the
|
|
|
cf1e18 |
int used to store the size.
|
|
|
cf1e18 |
|
|
|
cf1e18 |
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
|
|
|
cf1e18 |
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
cf1e18 |
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
|
|
cf1e18 |
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
|
|
|
cf1e18 |
---
|
|
|
cf1e18 |
src/fontfile/fontdir.c | 5 +++++
|
|
|
cf1e18 |
1 files changed, 5 insertions(+), 0 deletions(-)
|
|
|
cf1e18 |
|
|
|
cf1e18 |
diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c
|
|
|
cf1e18 |
index ef7ffa5..7271603 100644
|
|
|
cf1e18 |
--- a/src/fontfile/fontdir.c
|
|
|
cf1e18 |
+++ b/src/fontfile/fontdir.c
|
|
|
cf1e18 |
@@ -177,6 +177,11 @@ FontFileAddEntry(FontTablePtr table, FontEntryPtr prototype)
|
|
|
cf1e18 |
if (table->sorted)
|
|
|
cf1e18 |
return (FontEntryPtr) 0; /* "cannot" happen */
|
|
|
cf1e18 |
if (table->used == table->size) {
|
|
|
cf1e18 |
+ if (table->size >= ((INT32_MAX / sizeof(FontEntryRec)) - 100))
|
|
|
cf1e18 |
+ /* If we've read so many entries we're going to ask for 2gb
|
|
|
cf1e18 |
+ or more of memory, something is so wrong with this font
|
|
|
cf1e18 |
+ directory that we should just give up before we overflow. */
|
|
|
cf1e18 |
+ return NULL;
|
|
|
cf1e18 |
newsize = table->size + 100;
|
|
|
cf1e18 |
entry = realloc(table->entries, newsize * sizeof(FontEntryRec));
|
|
|
cf1e18 |
if (!entry)
|
|
|
cf1e18 |
--
|
|
|
cf1e18 |
1.7.1
|
|
|
cf1e18 |
|