mirrors/freetype
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent the overflows by a glyph with too many points or contours.

Browse Source
This commit is contained in:
suzuki toshiya 2009-07-08 14:26:51 +09:00
parent f4a0f93a14
commit 4c531460ed
4 changed files with 39 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ChangeLog
View File

@ -1,3 +1,22 @@
2009-07-08 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
Prevent the overflows by a glyph with too many points or contours.
The bug is reported by Boris Letocha <b.letocha@gmc.net>. See
http://lists.nongnu.org/archive/html/freetype-devel/2009-06/msg00031.html
http://lists.nongnu.org/archive/html/freetype-devel/2009-07/msg00002.html
* include/freetype/ftimage.h (FT_OUTLINE_CONTOURS_MAX,
FT_OUTLINE_POINTS_MAX): New macros to declare the maximum
values of FT_Outline.{n_contours,n_points}.
* src/base/ftgloadr.c (FT_GlyphLoader_CheckPoints): Check the
total numbers of points and contours cause no overflows in
FT_Outline.{n_contours,n_points}.
* include/freetype/internal/ftgloadr.h (FT_GLYPHLOADER_CHECK_P,
FT_GLYPHLOADER_CHECK_C): Compare the numbers of points and
contours as unsigned long number, instead of signed int, to
prevent the overflows on 16-bit systems.
2009-07-05 Bram Tassyns <bramt@enfocus.be>
Improve compatibility to Acroread.

5
include/freetype/ftimage.h
View File

@ -364,6 +364,11 @@ FT_BEGIN_HEADER
} FT_Outline;
/* Following limits must be consistent with */
/* FT_Outline.{n_contours,n_points} */
#define FT_OUTLINE_CONTOURS_MAX SHRT_MAX
#define FT_OUTLINE_POINTS_MAX SHRT_MAX
/*************************************************************************/
/* */

16
include/freetype/internal/ftgloadr.h
View File

@ -121,15 +121,15 @@ FT_BEGIN_HEADER
FT_UInt n_contours );
#define FT_GLYPHLOADER_CHECK_P( _loader, _count ) \
( (_count) == 0 || (int)((_loader)->base.outline.n_points + \
(_loader)->current.outline.n_points + \
(_count)) <= (int)(_loader)->max_points )
#define FT_GLYPHLOADER_CHECK_P( _loader, _count ) \
( (_count) == 0 || ((_loader)->base.outline.n_points + \
(_loader)->current.outline.n_points + \
(unsigned long)(_count)) <= (_loader)->max_points )
#define FT_GLYPHLOADER_CHECK_C( _loader, _count ) \
( (_count) == 0 || (int)((_loader)->base.outline.n_contours + \
(_loader)->current.outline.n_contours + \
(_count)) <= (int)(_loader)->max_contours )
#define FT_GLYPHLOADER_CHECK_C( _loader, _count ) \
( (_count) == 0 || ((_loader)->base.outline.n_contours + \
(_loader)->current.outline.n_contours + \
(unsigned long)(_count)) <= (_loader)->max_contours )
#define FT_GLYPHLOADER_CHECK_POINTS( _loader, _points,_contours ) \
( ( FT_GLYPHLOADER_CHECK_P( _loader, _points ) && \

7
src/base/ftgloadr.c
View File

@ -218,6 +218,9 @@
{
new_max = FT_PAD_CEIL( new_max, 8 );
if ( new_max > FT_OUTLINE_POINTS_MAX )
return FT_Err_Array_Too_Large;
if ( FT_RENEW_ARRAY( base->points, old_max, new_max ) ||
FT_RENEW_ARRAY( base->tags, old_max, new_max ) )
goto Exit;
@ -246,6 +249,10 @@
if ( new_max > old_max )
{
new_max = FT_PAD_CEIL( new_max, 4 );
if ( new_max > FT_OUTLINE_CONTOURS_MAX )
return FT_Err_Array_Too_Large;
if ( FT_RENEW_ARRAY( base->contours, old_max, new_max ) )
goto Exit;