[winfonts] Check alignment shift count for resource data (#45938). * src/winfonts/winfnt.c (fnt_face_get_dll_font): Implement it.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42
diff --git a/ChangeLog b/ChangeLog
index 47cfcf3..14e3ae1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
2015-09-13 Werner Lemberg <wl@gnu.org>
+ [winfonts] Check alignment shift count for resource data (#45938).
+
+ * src/winfonts/winfnt.c (fnt_face_get_dll_font): Implement it.
+
+2015-09-13 Werner Lemberg <wl@gnu.org>
+
[type1] Fix potential buffer overflow (#45923).
* src/type1/t1parse.c (T1_Get_Private_Dict): Assure `cur' doesn't
diff --git a/src/winfonts/winfnt.c b/src/winfonts/winfnt.c
index 36e3eb0..4bfa55a 100644
--- a/src/winfonts/winfnt.c
+++ b/src/winfonts/winfnt.c
@@ -320,6 +320,21 @@
size_shift = FT_GET_USHORT_LE();
+ /* Microsoft's specification of the executable-file header format */
+ /* for `New Executable' (NE) doesn't give a limit for the */
+ /* alignment shift count; however, in 1985, the year of the */
+ /* specification release, only 32bit values were supported, thus */
+ /* anything larger than 16 doesn't make sense in general, given */
+ /* that file offsets are 16bit values, shifted by the alignment */
+ /* shift count */
+ if ( size_shift > 16 )
+ {
+ FT_TRACE2(( "invalid alignment shift count for resource data\n" ));
+ error = FT_THROW( Invalid_File_Format );
+ goto Exit;
+ }
+
+
for (;;)
{
FT_UShort type_id, count;