src/base/ftmac.c, src/base/ftrfork.c, src/lzw/ftzopen.c,
src/raster/ftrend1.c, src/sfnt/ttpost.c, src/truetype/ttgxvar.c,
src/type42/t42parse.c, src/winfonts/winfnt.c: hardening the code
against out-of-bounds conditions when allocating arrays. This is
for the cases where FT_NEW_ARRAY and FT_RENEW_ARRAY are not used
already. Introducing the new FT_ALLOC_MULT and FT_REALLOC_MULT
macros.
include/freetype/internal/ftmemory.h, src/base/ftdbgmem.c,
src/base/ftutil.c: udpating the memory management functions and
macros to safely deal with array size buffer overflows, this
corresponds to attemps to allocate arrays that are too large. For
an example, consider the following code:
count = read_uint32_from_file();
array = malloc( sizeof(Item) * count );
for ( nn = 0; nn < count; nn++ )
array[nn] = read_item_from_file();
if 'count' is larger than FT_UINT_MAX/sizeof(Item), the multiplication
will overflow and the array allocated will be smaller than the data
read from the file. In this case, the heap will be trashed, and this
can be used as a denial-of-service, or make the engine crash later.
the FT_ARRAY_NEW and FT_ARRAY_RENEW macro now check that the new
count is no more than FT_INT_MAX/item_size, otherwise, a new error,
named 'FT_Err_Array_Too_Large' will be returned.
note that the memory debugger now works again when FT_DEBUG_MEMORY
is defined, and FT_STRICT_ALIASING has disappeared, the corresponding
code being now the default.
msn2@bidyut.com.
* include/freetype/config/ftstdlib.h (FT_CHAR_BIT, FT_FILE,
ft_fopen, ft_fclose, ft_fseek, ft_ftell, ft_fread, ft_smalloc,
ft_scalloc, ft_srealloc, ft_sfree, ft_labs): New wrapper macros for
C library functions. Update all users accordingly (and catch some
other places where the C library function was used instead of the
wrapper functions).
* src/base/ftsystem.c: Don't include stdio.h and stdlib.h.
* src/gzip/zutil.h [MSDOS && !(__TURBOC__ || __BORLANDC__)]: Don't
include malloc.h.
* src/cff/cffload.c (cff_charset_load): Set `charset->max_cid'.
* src/cff/cffgload.c (cff_slot_load): Change type of third parameter
to `FT_UInt'.
Check range of `glyph_index'.
* src/cff/cffgload.h: Updated.
include/freetype/cache/ftccmap.h,
include/freetype/cache/ftcglyph.h
include/freetype/cache/ftcimage.h
include/freetype/cache/ftcmanag.h
include/freetype/cache/ftcmru.h
include/freetype/cache/ftcsbits.h:
removing these header files from the public include directory.
* include/freetype/config/ftheader.h:
changing the definition of FT_CACHE_INTERNAL_XXX_H macros to
redirect to FT_CACHE_H instead
* src/cache/ftcbasic.c, src/cache/ftccache.c, src/cache/ftccache.h,
src/cache/ftccback.h, src/cache/ftccmap.c, src/cache/ftcglyph.c,
src/cache/ftcglyph.h, src/cache/ftcimage.c, src/cache/ftcimage.h,
src/cache/ftcmanag.c, src/cache/ftcmanag.h, src/cache/ftcmru.c,
src/cache/ftcmru.h, src/cache/ftcsbits.c, src/cache/ftcsbits.h:
modifications to prevent using the FT_CACHE_INTERNAL_XXX_H macros,
and grab the headers in 'src/cache' instead (see below).
src/cache/ftcsbits.h, src/cache/ftcmanag.h, src/cache/ftccmap.h,
src/cache/ftcmru.h: copying the cache's internal header files which
were located in 'include/freetype/cache' to the 'src/cache' directory
instead.
Note that these files are not used by FreeType clients, all cache
public APIs have been already moved to include/freetype/ftcache.h,
and the FT_CACHE_INTERNAL_XXXX_H macros all resolve to it.
the move is to allow us to modify the internals without intereference
from rogue clients. Note that there are no known client that accesses
the cache internals at the moment.
