Commit 0545ec1ca36b27cb928128870a83e5f668980bc5
2009-03-20T06:49:10
Protect against invalid SID values in CFFs. Problem reported by Tavis Ormandy <taviso@google.com>. * src/cff/cffload.c (cff_charset_load): Reject SID values larger than 64999.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64
diff --git a/ChangeLog b/ChangeLog
index 3c6ea08..512d99c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2009-03-20 Werner Lemberg <wl@gnu.org>
+
+ Protect against invalid SID values in CFFs.
+
+ Problem reported by Tavis Ormandy <taviso@google.com>.
+
+ * src/cff/cffload.c (cff_charset_load): Reject SID values larger
+ than 64999.
+
2009-03-19 Vincent Richomme <richom.v@free.fr>
Update WinCE Visual C project files.
diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index 22163fb..24b899d 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -842,7 +842,20 @@
goto Exit;
for ( j = 1; j < num_glyphs; j++ )
- charset->sids[j] = FT_GET_USHORT();
+ {
+ FT_UShort sid = FT_GET_USHORT();
+
+
+ /* this constant is given in the CFF specification */
+ if ( sid < 65000 )
+ charset->sids[j] = sid;
+ else
+ {
+ FT_ERROR(( "cff_charset_load:"
+ " invalid SID value %d set to zero\n", sid ));
+ charset->sids[j] = 0;
+ }
+ }
FT_FRAME_EXIT();
}
@@ -875,6 +888,20 @@
goto Exit;
}
+ /* check whether the range contains at least one valid glyph; */
+ /* the constant is given in the CFF specification */
+ if ( glyph_sid >= 65000 ) {
+ FT_ERROR(( "cff_charset_load: invalid SID range\n" ));
+ error = CFF_Err_Invalid_File_Format;
+ goto Exit;
+ }
+
+ /* try to rescue some of the SIDs if `nleft' is too large */
+ if ( nleft > 65000 - 1 || glyph_sid >= 65000 - nleft ) {
+ FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" ));
+ nleft = 65000 - 1 - glyph_sid;
+ }
+
/* Fill in the range of sids -- `nleft + 1' glyphs. */
for ( i = 0; j < num_glyphs && i <= nleft; i++, j++, glyph_sid++ )
charset->sids[j] = glyph_sid;