Commit 4f0a55d15ed1c9af267ed8223cc2f04307a3d656
2023-03-19T10:13:52
[cff] Rework the stream limit checks. The old stream limit checks, before 6986ddac1ece, were good but pointless for the crafted t2_strings. Checking limits there is not necessary as they are created to hold all data. By using two conditions, we can detect the actual crossing of the stream boundary as appropriate for the stream pointer only. The t2_strings parsing will not be triggering these checks. * src/cff/cffparse.c (cff_parser_within_limits): Removed. (cff_parse_real, cff_parse_integer): Redesign the stream limit check. (cff_parse_num, do fixed, cff_parse_fixed_dynamic): Update callers.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
diff --git a/src/cff/cffparse.c b/src/cff/cffparse.c
index 7476aed..35d4fea 100644
--- a/src/cff/cffparse.c
+++ b/src/cff/cffparse.c
@@ -110,55 +110,14 @@
}
- /* Assuming `first >= last'. */
-
- static FT_Error
- cff_parser_within_limits( CFF_Parser parser,
- FT_Byte* first,
- FT_Byte* last )
- {
-#ifndef CFF_CONFIG_OPTION_OLD_ENGINE
-
- /* Fast path for regular FreeType builds with the "new" engine; */
- /* `first >= parser->start' can be assumed. */
-
- FT_UNUSED( first );
-
- return last < parser->limit ? FT_Err_Ok : FT_THROW( Invalid_Argument );
-
-#else /* CFF_CONFIG_OPTION_OLD_ENGINE */
-
- FT_ListNode node;
-
-
- if ( first >= parser->start &&
- last < parser->limit )
- return FT_Err_Ok;
-
- node = parser->t2_strings.head;
-
- while ( node )
- {
- CFF_T2_String t2 = (CFF_T2_String)node->data;
-
-
- if ( first >= t2->start &&
- last < t2->limit )
- return FT_Err_Ok;
-
- node = node->next;
- }
-
- return FT_THROW( Invalid_Argument );
-
-#endif /* CFF_CONFIG_OPTION_OLD_ENGINE */
- }
-
+ /* The parser limit checks in the next two functions are supposed */
+ /* to detect the immediate crossing of the stream boundary. They */
+ /* shall not be triggered from the distant t2_strings buffers. */
/* read an integer */
static FT_Long
- cff_parse_integer( CFF_Parser parser,
- FT_Byte* start )
+ cff_parse_integer( FT_Byte* start,
+ FT_Byte* limit )
{
FT_Byte* p = start;
FT_Int v = *p++;
@@ -167,14 +126,14 @@
if ( v == 28 )
{
- if ( cff_parser_within_limits( parser, p, p + 1 ) )
+ if ( p + 2 > limit && limit >= p )
goto Bad;
val = (FT_Short)( ( (FT_UShort)p[0] << 8 ) | p[1] );
}
else if ( v == 29 )
{
- if ( cff_parser_within_limits( parser, p, p + 3 ) )
+ if ( p + 4 > limit && limit >= p )
goto Bad;
val = (FT_Long)( ( (FT_ULong)p[0] << 24 ) |
@@ -188,14 +147,14 @@
}
else if ( v < 251 )
{
- if ( cff_parser_within_limits( parser, p, p ) )
+ if ( p + 1 > limit && limit >= p )
goto Bad;
val = ( v - 247 ) * 256 + p[0] + 108;
}
else
{
- if ( cff_parser_within_limits( parser, p, p ) )
+ if ( p + 1 > limit && limit >= p )
goto Bad;
val = -( v - 251 ) * 256 - p[0] - 108;
@@ -244,10 +203,10 @@
/* read a real */
static FT_Fixed
- cff_parse_real( CFF_Parser parser,
- FT_Byte* start,
- FT_Long power_ten,
- FT_Long* scaling )
+ cff_parse_real( FT_Byte* start,
+ FT_Byte* limit,
+ FT_Long power_ten,
+ FT_Long* scaling )
{
FT_Byte* p = start;
FT_Int nib;
@@ -282,7 +241,7 @@
p++;
/* Make sure we don't read past the end. */
- if ( cff_parser_within_limits( parser, p, p ) )
+ if ( p + 1 > limit && limit >= p )
goto Bad;
}
@@ -319,7 +278,7 @@
p++;
/* Make sure we don't read past the end. */
- if ( cff_parser_within_limits( parser, p, p ) )
+ if ( p + 1 > limit && limit >= p )
goto Bad;
}
@@ -358,7 +317,7 @@
p++;
/* Make sure we don't read past the end. */
- if ( cff_parser_within_limits( parser, p, p ) )
+ if ( p + 1 > limit && limit >= p )
goto Bad;
}
@@ -525,7 +484,7 @@
if ( **d == 30 )
{
/* binary-coded decimal is truncated to integer */
- return cff_parse_real( parser, *d, 0, NULL ) >> 16;
+ return cff_parse_real( *d, parser->limit, 0, NULL ) >> 16;
}
else if ( **d == 255 )
@@ -551,7 +510,7 @@
}
else
- return cff_parse_integer( parser, *d );
+ return cff_parse_integer( *d, parser->limit );
}
@@ -562,10 +521,10 @@
FT_Long scaling )
{
if ( **d == 30 )
- return cff_parse_real( parser, *d, scaling, NULL );
+ return cff_parse_real( *d, parser->limit, scaling, NULL );
else
{
- FT_Long val = cff_parse_integer( parser, *d );
+ FT_Long val = cff_parse_integer( *d, parser->limit );
if ( scaling )
@@ -630,14 +589,14 @@
FT_ASSERT( scaling );
if ( **d == 30 )
- return cff_parse_real( parser, *d, 0, scaling );
+ return cff_parse_real( *d, parser->limit, 0, scaling );
else
{
FT_Long number;
FT_Int integer_length;
- number = cff_parse_integer( parser, d[0] );
+ number = cff_parse_integer( *d, parser->limit );
if ( number > 0x7FFFL )
{