Commit d38ba0c92d7c07e8a187a501c0e923e507c7bda6
2010-09-19T20:51:19
Minor fixes. * src/cff/cffload.c (cff_charset_compute_cids): `charset->sids[i]' is `FT_UShort'. (cff_index_access_element): Don't use additions in comparison. * src/sfnt/ttpost.c (load_format_20): Make `post_limit' of type `FT_Long'. Don't use additions in comparison. Improve tracing messages. (load_format_25, load_post_names): Make `post_limit' of type `FT_Long'.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257
diff --git a/ChangeLog b/ChangeLog
index e6d0602..a377b86 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,13 +1,27 @@
+2010-09-19 Werner Lemberg <wl@gnu.org>
+
+ Minor fixes.
+
+ * src/cff/cffload.c (cff_charset_compute_cids): `charset->sids[i]'
+ is `FT_UShort'.
+ (cff_index_access_element): Don't use additions in comparison.
+ * src/sfnt/ttpost.c (load_format_20): Make `post_limit' of type
+ `FT_Long'.
+ Don't use additions in comparison.
+ Improve tracing messages.
+ (load_format_25, load_post_names): Make `post_limit' of type
+ `FT_Long'.
+
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[cff] Truncate the element length at the end of the stream.
See Savannah bug #30975.
- * src/cff/cffload.c (cff_index_access_element): `off2', the
- offset to the next element is truncated at the end of the
- stream to prevent invalid I/O. As `off1', the offset to the
- requested element has been checked by FT_STREAM_SEEK(),
- `off2' should be checked similarly.
+ * src/cff/cffload.c (cff_index_access_element): `off2', the offset
+ to the next element is truncated at the end of the stream to prevent
+ invalid I/O. As `off1', the offset to the requested element has
+ been checked by FT_STREAM_SEEK(), `off2' should be checked
+ similarly.
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
@@ -15,17 +29,17 @@
See Savannah bug #30975.
* src/cff/cffload.c (cff_charset_compute_cids): Ignore CID if
- greater than 0xFFFFU. CFF font spec does not mention about
- maximum CID in the font, but PostScript and PDF spec define
- that maximum CID is 0xFFFFU.
+ greater than 0xFFFFU. CFF font spec does not mention maximum CID in
+ the font, but PostScript and PDF spec define that maximum CID is
+ 0xFFFFU.
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[cff] Make trace message in cff_charset_load() verbose.
See Savannah bug #30975.
- * src/cff/cffload.c (cff_charset_load): Report the original
- `nleft' and truncated `nleft'.
+ * src/cff/cffload.c (cff_charset_load): Report the original `nleft'
+ and truncated `nleft'.
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
@@ -33,45 +47,47 @@
See Savannah bug #30975.
* src/cff/cffload.c (cff_charset_compute_cids): Don't increment
- max_cid after detecting max CID. The array CFF_Charset->cids
- is allocated by max_cid + 1.
- (cff_charset_cid_to_gindex): Permit CID is less than or equal
- to CFF_Charset->max_cid.
+ max_cid after detecting max CID. The array CFF_Charset->cids is
+ allocated by max_cid + 1.
+ (cff_charset_cid_to_gindex): Permit CID is less than or equal to
+ CFF_Charset->max_cid.
* src/cff/cffobjs.c (cff_face_init): FT_Face->num_glyphs is
calculated as CFF_Charset->max_cid + 1.
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[truetype] Sanitize the broken offsets in `loca'.
+ See Savannah bug #31040.
* src/truetype/ttpload.c (tt_face_get_location): If `pos1', the
offset to the requested entry in `glyf' exceeds the end of the
- table, return offset=0, length=0. If `pos2', the offset to the
- next entry in `glyf' exceeds the end of the table, truncate
- the entry length at the end of `glyf' table.
- See Savannah bug #31040.
+ table, return offset=0, length=0. If `pos2', the offset to the next
+ entry in `glyf' exceeds the end of the table, truncate the entry
+ length at the end of `glyf' table.
2010-09-19 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[sfnt] Prevent overrunning in `post' table parser.
+ See Savannah bug #31040.
- * src/sfnt/ttpost.c (load_post_names): Get the length of
- `post' table and pass the limit of `post' table to
- load_format_20() and load_format_25().
- (load_format_20): Stop the parsing when we reached at the
- limit of `post' table. If more glyph names are required,
- they are filled by NULL names. See Savannah bug #31040.
+ * src/sfnt/ttpost.c (load_post_names): Get the length of `post'
+ table and pass the limit of `post' table to load_format_20() and
+ load_format_25().
+ (load_format_20): Stop the parsing when we reached at the limit of
+ `post' table. If more glyph names are required, they are filled by
+ NULL names.
2010-09-17 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
[truetype] Don't duplicate size->twilight structure to be freed.
+ See Savannah bug #31040 for detail.
* src/truetype/ttinterp.c (free_buffer_in_size): Don't duplicate
FT_GlyphZoneRec size->twilight to be freed. If duplicated,
FT_FREE() erases the duplicated pointers only and leave original
pointers. They can cause the double-free crash when the burst
- errors occur in TrueType interpreter and free_buffer_in_size()
- is invoked repeatedly. See Savannah bug #31040 for detail.
+ errors occur in TrueType interpreter and free_buffer_in_size() is
+ invoked repeatedly.
2010-09-15 Werner Lemberg <wl@gnu.org>
diff --git a/src/cff/cffload.c b/src/cff/cffload.c
index c0f2109..000cbe3 100644
--- a/src/cff/cffload.c
+++ b/src/cff/cffload.c
@@ -519,9 +519,10 @@
}
}
- /* XXX: should check off2 does not exceed the end of this entry */
- /* at present, only truncate off 2 at the end of this stream */
- if ( idx->data_offset + off2 - 1 > stream->size )
+ /* XXX: should check off2 does not exceed the end of this entry; */
+ /* at present, only truncate off2 at the end of this stream */
+ if ( off2 > stream->size + 1 ||
+ idx->data_offset > stream->size - off2 + 1 )
{
FT_ERROR(( "cff_index_access_element:"
" offset to next entry (%d)"
@@ -791,16 +792,11 @@
for ( i = 0; i < num_glyphs; i++ )
{
- if ( charset->sids[i] > 0xFFFFU )
- FT_ERROR(( "cff_charset_compute_cids():"
- " ignore CID (0x%lx) for SID (0x%lx),"
- " greater than PS/PDF spec\n",
- charset->sids[i], i ));
- else if ( charset->sids[i] > max_cid )
+ if ( charset->sids[i] > max_cid )
max_cid = charset->sids[i];
}
- if ( FT_NEW_ARRAY( charset->cids, max_cid + 1 ) )
+ if ( FT_NEW_ARRAY( charset->cids, (FT_ULong)max_cid + 1 ) )
goto Exit;
/* When multiple GIDs map to the same CID, we choose the lowest */
diff --git a/src/sfnt/ttpost.c b/src/sfnt/ttpost.c
index 5059fd5..642f1ab 100644
--- a/src/sfnt/ttpost.c
+++ b/src/sfnt/ttpost.c
@@ -5,7 +5,7 @@
/* Postcript name table processing for TrueType and OpenType fonts */
/* (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2006, 2007, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2003, 2006, 2007, 2008, 2009, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -154,7 +154,7 @@
static FT_Error
load_format_20( TT_Face face,
FT_Stream stream,
- FT_ULong post_limit )
+ FT_Long post_limit )
{
FT_Memory memory = stream->memory;
FT_Error error;
@@ -231,30 +231,34 @@
FT_UInt len;
- FT_TRACE7(( "load_format_20: %d byte left in post table\n",
- post_limit - FT_STREAM_POS() ));
-
if ( FT_STREAM_POS() >= post_limit )
{
FT_ERROR(( "load_format_20:"
- " all entries in post table is already parsed,"
- " put NULL name for gid=%d\n", n ));
+ " all entries in post table are already parsed,"
+ " using NULL for gid %d\n", n ));
len = 0;
}
- else if ( FT_READ_BYTE( len ) )
- goto Fail1;
+ else
+ {
+ FT_TRACE6(( "load_format_20: %d byte left in post table\n",
+ post_limit - FT_STREAM_POS() ));
- if ( len > 0 && FT_STREAM_POS() + len > post_limit )
+ if ( FT_READ_BYTE( len ) )
+ goto Fail1;
+ }
+
+ if ( (FT_Int)len > post_limit ||
+ FT_STREAM_POS() > post_limit - (FT_Int)len )
{
FT_ERROR(( "load_format_20:"
- " too large string length (%d)"
- " truncate at the end of post table (%d byte left)\n",
+ " exceeding string length (%d),"
+ " truncating at end of post table (%d byte left)\n",
len, post_limit - FT_STREAM_POS() ));
len = FT_MAX( 0, post_limit - FT_STREAM_POS() );
}
if ( FT_NEW_ARRAY( name_strings[n], len + 1 ) ||
- FT_STREAM_READ ( name_strings[n], len ) )
+ FT_STREAM_READ( name_strings[n], len ) )
goto Fail1;
name_strings[n][len] = '\0';
@@ -294,7 +298,7 @@
static FT_Error
load_format_25( TT_Face face,
FT_Stream stream,
- FT_ULong post_limit )
+ FT_Long post_limit )
{
FT_Memory memory = stream->memory;
FT_Error error;
@@ -302,6 +306,8 @@
FT_Int num_glyphs;
FT_Char* offset_table = 0;
+ FT_UNUSED( post_limit );
+
/* UNDOCUMENTED! This value appears only in the Apple TT specs. */
if ( FT_READ_USHORT( num_glyphs ) )
@@ -361,7 +367,8 @@
FT_Stream stream;
FT_Error error;
FT_Fixed format;
- FT_ULong post_len, post_limit;
+ FT_ULong post_len;
+ FT_Long post_limit;
/* get a stream for the face's resource */