src/lzw/ftzopen.c


Log

Author Commit Date CI Message
Tomas Hoger 487913d9 2011-09-11T09:18:10 Slightly improve LZW_CLEAR handling. * src/lzw/ftzopen.c (ft_lzwstate_io) <FT_LZW_PHASE_CODE>: Ensure that subsequent (modulo garbage byte(s)) LZW_CLEAR codes are handled as clear codes. This also re-sets old_code and old_char to predictable values, which is a little better than using `random' ones if the code following LZW_CLEAR is invalid.
Tomas Hoger 83cb6c00 2011-09-11T09:13:45 Add explicit LZW decompression stack size limit. Stack larger than 1<<LZW_MAX_BITS is never needed if prefix table is constructed correctly. It's even less than that, see e.g. libarchive code comment for a better size upper bound: http://code.google.com/p/libarchive/source/browse/trunk/libarchive/archive_read_support_filter_compress.c?r=3635#121 This patch adds explicit stack size limit, enforced when stack is realloced. An alternative is to ensure that code < state->prefix[code - 256] when traversing prefix table. Such check is less efficient and should not be required if prefix table is constructed correctly in the first place. * src/lzw/ftzopen.c (ft_lzwstate_stack_grow): Implement it.
Tomas Hoger 86c3c69c 2011-09-11T09:08:40 Protect against loops in the prefix table. LZW decompressor did not sufficiently check codes read from the input LZW stream. A specially-crafted or corrupted input could create a loop in the prefix table, which leads to memory usage spikes, as there's no decompression stack size limit. * src/lzw/ftzopen.c (ft_lzwstate_io) <FT_LZW_PHASE_START>: First code in valid LZW stream must be 0..255. <FT_LZW_PHASE_CODE>: In the special KwKwK case, code == free_ent, code > free_ent is invalid.
suzuki toshiya f420757c 2009-08-01T00:30:14 lzw: Count the size of the memory object by ptrdiff_t.
Werner Lemberg a49db4f8 2009-03-20T07:30:43 Copyright.
Werner Lemberg 0a05ba25 2009-03-20T07:19:45 Protect against malformed compressed data. Problem reported by Tavis Ormandy <taviso@google.com>. * src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is zero.
Werner Lemberg 1c8980ef 2007-05-25T07:11:12 * docs/CHANGES: Updated. Formatting.
David Turner 3e2f953a 2007-05-22T13:10:59 real fix for bug #19910. the .Z format is really badly designed :-(
David Turner 0d0365ec 2007-05-22T09:53:44 avoid heap explosion in the case of malformed .Z font files related to bug #19910, but not a bugfix yet
Werner Lemberg c6afa122 2006-05-02T22:22:16 * include/freetype/internal/ftmemory.h: s/new/newsz/ (for C++). (FT_ALLOC): Remove redundant redefinition. * builds/compiler/gcc-dev.mk (CFLAGS) [g++]: Don't use `-Wstrict-prototypes'. * src/base/ftstream.c (FT_Stream_EnterFrame): Add cast. Formatting, copyright years.
David Turner 9ca78256 2006-05-02T09:00:29 * include/freetype/internal/ftmemory.h, src/base/ftbitmap.c, src/base/ftmac.c, src/base/ftrfork.c, src/lzw/ftzopen.c, src/raster/ftrend1.c, src/sfnt/ttpost.c, src/truetype/ttgxvar.c, src/type42/t42parse.c, src/winfonts/winfnt.c: hardening the code against out-of-bounds conditions when allocating arrays. This is for the cases where FT_NEW_ARRAY and FT_RENEW_ARRAY are not used already. Introducing the new FT_ALLOC_MULT and FT_REALLOC_MULT macros.
Werner Lemberg 84cacd23 2005-10-23T19:25:41 formatting, comment clean-up
Werner Lemberg 560d5fed 2005-10-21T09:08:28 Minor cleanups. Copyright issues.
David Turner c1b6d082 2005-10-20T15:33:34 * src/base/ftdbgmem.c: fixes to better account for memory reallocations * src/lzw/ftlzw2.c, src/lzw/ftzopen.h, src/lzw/ftzopen.c, src/lzw/rules.mk: first version of LZW loader re-implementation. Apparently, saves about 260 KB of heap memory when loading tir24.pcf.Z