Commit 14a16e3430ce85538ba9116816cf463cf8827708
2011-11-08T08:27:42
[cid] Various loading fixes. * src/cid/cidload.c (cid_load_keyword) <default>, (parse_font_matrix, parse_expansion_factor): Correctly check number of dictionaries. (cid_read_subrs): Protect against invalid values of `num_subrs'. Assure that the elements of the `offsets' array are ascending.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
diff --git a/ChangeLog b/ChangeLog
index a5bf94e..f40b548 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2011-11-08 Braden Thomas <bthomas@apple.com>
+
+ [cid] Various loading fixes.
+
+ * src/cid/cidload.c (cid_load_keyword) <default>,
+ (parse_font_matrix, parse_expansion_factor): Correctly check number
+ of dictionaries.
+ (cid_read_subrs): Protect against invalid values of `num_subrs'.
+ Assure that the elements of the `offsets' array are ascending.
+
2011-11-05 Werner Lemberg <wl@gnu.org>
* README: We use copyright ranges also.
diff --git a/src/cid/cidload.c b/src/cid/cidload.c
index 3bb3594..5f712bc 100644
--- a/src/cid/cidload.c
+++ b/src/cid/cidload.c
@@ -4,7 +4,7 @@
/* */
/* CID-keyed Type1 font loader (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2009 by */
+/* Copyright 1996-2006, 2009, 2011 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -110,7 +110,7 @@
CID_FaceDict dict;
- if ( parser->num_dict < 0 )
+ if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
{
FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
keyword->ident ));
@@ -158,7 +158,7 @@
FT_Fixed temp_scale;
- if ( parser->num_dict >= 0 )
+ if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
{
dict = face->cid.font_dicts + parser->num_dict;
matrix = &dict->font_matrix;
@@ -249,7 +249,7 @@
CID_FaceDict dict;
- if ( parser->num_dict >= 0 )
+ if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
{
dict = face->cid.font_dicts + parser->num_dict;
@@ -413,12 +413,25 @@
FT_Byte* p;
+ /* Check for possible overflow. */
+ if ( num_subrs == FT_UINT_MAX )
+ {
+ error = CID_Err_Syntax_Error;
+ goto Fail;
+ }
+
/* reallocate offsets array if needed */
if ( num_subrs + 1 > max_offsets )
{
FT_UInt new_max = FT_PAD_CEIL( num_subrs + 1, 4 );
+ if ( new_max <= max_offsets )
+ {
+ error = CID_Err_Syntax_Error;
+ goto Fail;
+ }
+
if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
goto Fail;
@@ -436,6 +449,11 @@
FT_FRAME_EXIT();
+ /* offsets must be ordered */
+ for ( count = 1; count <= num_subrs; count++ )
+ if ( offsets[count - 1] > offsets[count] )
+ goto Fail;
+
/* now, compute the size of subrs charstrings, */
/* allocate, and read them */
data_len = offsets[num_subrs] - offsets[0];