summaryrefslogtreecommitdiff
path: root/dviware/dvipng/tfm.c
diff options
context:
space:
mode:
Diffstat (limited to 'dviware/dvipng/tfm.c')
-rw-r--r--dviware/dvipng/tfm.c16
1 files changed, 12 insertions, 4 deletions
diff --git a/dviware/dvipng/tfm.c b/dviware/dvipng/tfm.c
index 5bfdb4b2b8..ee04383cb4 100644
--- a/dviware/dvipng/tfm.c
+++ b/dviware/dvipng/tfm.c
@@ -18,7 +18,7 @@
License along with this program. If not, see
<http://www.gnu.org/licenses/>.
- Copyright (C) 2002-2009 Jan-Åke Larsson
+ Copyright (C) 2002-2009, 2019 Jan-Åke Larsson
************************************************************************/
@@ -36,17 +36,20 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
("\n OPEN METRICS:\t'%s'", tfmname));
if (MmapFile(tfmname,&fmmap)) return(false);
position=(unsigned char*)fmmap.data;
+ if (fmmap.size<10) Fatal("TFM file %s ends prematurely",tfmname);
lh = UNumRead(position+2,2);
bc = UNumRead(position+4,2);
ec = UNumRead(position+6,2);
nw = UNumRead(position+8,2);
DEBUG_PRINT(DEBUG_TFM,(" %d %d %d %d",lh,bc,ec,nw));
if (nw>0) {
+ unsigned char *end=(unsigned char *) fmmap.data+fmmap.size;
if ((width=malloc(nw*sizeof(dviunits)))==NULL)
Fatal("cannot allocate memory for TFM widths");
c=0;
position=position+24+(lh+ec-bc+1)*4;
while( c < nw ) {
+ if (position >= end - 4) Fatal("TFM file %s ends prematurely",tfmname);
width[c] = SNumRead(position,4);
c++;
position += 4;
@@ -55,18 +58,23 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
c=bc;
position=(unsigned char*)fmmap.data+24+lh*4;
while(c <= ec) {
+ if (position >= end) Fatal("TFM file %s ends prematurely",tfmname);
DEBUG_PRINT(DEBUG_TFM,("\n@%ld TFM METRICS:\t",
- (long)position - (long)fmmap.data));
+ (long)((char *)position - fmmap.data)));
if ((tcharptr=malloc(sizeof(struct char_entry)))==NULL)
Fatal("cannot allocate memory for TFM char entry");
tcharptr->data=NULL;
- tcharptr->tfmw=width[*position];
+ if (*position < nw) {
+ tcharptr->tfmw=width[*position];
+ } else {
+ Fatal("TFM file %s lacks width for char %u", tfmname, *position);
+ }
DEBUG_PRINT(DEBUG_TFM,("%d [%d] %d",c,*position,tcharptr->tfmw));
tcharptr->tfmw = (dviunits)
((int64_t) tcharptr->tfmw * tfontp->s / (1 << 20));
DEBUG_PRINT(DEBUG_TFM,(" (%d)",tcharptr->tfmw));
if (c >= NFNTCHARS) /* Only positive for now */
- Fatal("tfm file %s exceeds char numbering limit",tfmname);
+ Fatal("tfm file %s exceeds char numbering limit %u",tfmname,NFNTCHARS);
tfontp->chr[c] = tcharptr;
c++;
position += 4;