Commit 65be4b21127e99ad652d4f8a1154679c4bea6677
2021-10-21T09:55:28
[mm] Delay setting blend weight and design position. Previously the `blend->weight_vector`, `blend->default_weight_vector`, and `blend->design_pos` were set early to allocated but uninitialized memory under the assumption that the memory would eventually be initialized. However, it is possible that some of the required keywords may not actually be present, leaving the memory uninitialized. This is different from a present but invalid table, which would produce an error. Reported as https://bugs.chromium.org/p/chromium/issues/detail?id=1261762 * src/type1/t1load.c (t1_allocate_blend): Remove early allocation and initialization. (parse_blend_design_positions, parse_weight_vector): Parse into local and assign to blend if valid. (T1_Open_Face): Check that if a blend exists that it has the weight vector and design positions.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173
diff --git a/src/type1/t1load.c b/src/type1/t1load.c
index 0838e1a..8fe16f4 100644
--- a/src/type1/t1load.c
+++ b/src/type1/t1load.c
@@ -117,6 +117,9 @@
goto Exit;
blend->num_default_design_vector = 0;
+ blend->weight_vector = NULL;
+ blend->default_weight_vector = NULL;
+ blend->design_pos[0] = NULL;
face->blend = blend;
}
@@ -130,14 +133,11 @@
/* allocate the blend `private' and `font_info' dictionaries */
- if ( FT_QNEW_ARRAY( blend->font_infos[1], num_designs ) ||
- FT_QNEW_ARRAY( blend->privates [1], num_designs ) ||
- FT_QNEW_ARRAY( blend->bboxes [1], num_designs ) ||
- FT_QNEW_ARRAY( blend->weight_vector, num_designs * 2 ) )
+ if ( FT_QNEW_ARRAY( blend->font_infos[1], num_designs ) ||
+ FT_QNEW_ARRAY( blend->privates [1], num_designs ) ||
+ FT_QNEW_ARRAY( blend->bboxes [1], num_designs ) )
goto Exit;
- blend->default_weight_vector = blend->weight_vector + num_designs;
-
blend->font_infos[0] = &face->type1.font_info;
blend->privates [0] = &face->type1.private_dict;
blend->bboxes [0] = &face->type1.font_bbox;
@@ -164,21 +164,6 @@
blend->num_axis = num_axis;
}
- /* allocate the blend design pos table if needed */
- num_designs = blend->num_designs;
- num_axis = blend->num_axis;
- if ( num_designs && num_axis && blend->design_pos[0] == NULL )
- {
- FT_UInt n;
-
-
- if ( FT_QNEW_ARRAY( blend->design_pos[0], num_designs * num_axis ) )
- goto Exit;
-
- for ( n = 1; n < num_designs; n++ )
- blend->design_pos[n] = blend->design_pos[0] + num_axis * n;
- }
-
Exit:
return error;
@@ -872,12 +857,14 @@
{
T1_TokenRec design_tokens[T1_MAX_MM_DESIGNS];
FT_Int num_designs;
- FT_Int num_axis;
+ FT_Int num_axis = 0; /* make compiler happy */
T1_Parser parser = &loader->parser;
-
+ FT_Memory memory = face->root.memory;
FT_Error error = FT_Err_Ok;
- PS_Blend blend;
+ FT_Fixed* design_pos[T1_MAX_MM_DESIGNS];
+
+ design_pos[0] = NULL;
/* get the array of design tokens -- compute number of designs */
T1_ToTokenArray( parser, design_tokens,
@@ -899,12 +886,10 @@
{
FT_Byte* old_cursor = parser->root.cursor;
FT_Byte* old_limit = parser->root.limit;
- FT_Int n;
+ FT_Int n,nn;
+ PS_Blend blend;
- blend = face->blend;
- num_axis = 0; /* make compiler happy */
-
FT_TRACE4(( " [" ));
for ( n = 0; n < num_designs; n++ )
@@ -937,7 +922,13 @@
(FT_UInt)num_axis );
if ( error )
goto Exit;
- blend = face->blend;
+
+ /* allocate a blend design pos table */
+ if ( FT_QNEW_ARRAY( design_pos[0], num_designs * num_axis ) )
+ goto Exit;
+
+ for ( nn = 1; nn < num_designs; nn++ )
+ design_pos[nn] = design_pos[0] + num_axis * nn;
}
else if ( n_axis != num_axis )
{
@@ -955,8 +946,8 @@
parser->root.cursor = token2->start;
parser->root.limit = token2->limit;
- blend->design_pos[n][axis] = T1_ToFixed( parser, 0 );
- FT_TRACE4(( " %f", (double)blend->design_pos[n][axis] / 65536 ));
+ design_pos[n][axis] = T1_ToFixed( parser, 0 );
+ FT_TRACE4(( " %f", (double)design_pos[n][axis] / 65536 ));
}
FT_TRACE4(( "]" )) ;
}
@@ -965,9 +956,21 @@
loader->parser.root.cursor = old_cursor;
loader->parser.root.limit = old_limit;
+
+ /* a valid BlendDesignPosition has been parsed */
+ blend = face->blend;
+ if ( blend->design_pos[0] )
+ FT_FREE( blend->design_pos[0] );
+
+ for ( n = 0; n < num_designs; n++ )
+ {
+ blend->design_pos[n] = design_pos[n];
+ design_pos[n] = NULL;
+ }
}
Exit:
+ FT_FREE( design_pos[0] );
loader->parser.root.error = error;
}
@@ -1088,6 +1091,7 @@
T1_TokenRec design_tokens[T1_MAX_MM_DESIGNS];
FT_Int num_designs;
FT_Error error = FT_Err_Ok;
+ FT_Memory memory = face->root.memory;
T1_Parser parser = &loader->parser;
PS_Blend blend = face->blend;
T1_Token token;
@@ -1129,6 +1133,12 @@
goto Exit;
}
+ if ( !blend->weight_vector )
+ if ( FT_QNEW_ARRAY( blend->weight_vector, num_designs * 2 ) )
+ goto Exit;
+
+ blend->default_weight_vector = blend->weight_vector + num_designs;
+
old_cursor = parser->root.cursor;
old_limit = parser->root.limit;
@@ -2578,7 +2588,15 @@
( !face->blend->num_designs || !face->blend->num_axis ) )
T1_Done_Blend( face );
- /* another safety check */
+ /* the font may have no valid WeightVector */
+ if ( face->blend && !face->blend->weight_vector )
+ T1_Done_Blend( face );
+
+ /* the font may have no valid BlendDesignPositions */
+ if ( face->blend && !face->blend->design_pos[0] )
+ T1_Done_Blend( face );
+
+ /* the font may have no valid BlendDesignMap */
if ( face->blend )
{
FT_UInt i;