diff options
Diffstat (limited to 'dviware/dvipng/tfm.c')
-rw-r--r-- | dviware/dvipng/tfm.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/dviware/dvipng/tfm.c b/dviware/dvipng/tfm.c index 5bfdb4b2b8..ee04383cb4 100644 --- a/dviware/dvipng/tfm.c +++ b/dviware/dvipng/tfm.c @@ -18,7 +18,7 @@ License along with this program. If not, see <http://www.gnu.org/licenses/>. - Copyright (C) 2002-2009 Jan-Åke Larsson + Copyright (C) 2002-2009, 2019 Jan-Åke Larsson ************************************************************************/ @@ -36,17 +36,20 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname) ("\n OPEN METRICS:\t'%s'", tfmname)); if (MmapFile(tfmname,&fmmap)) return(false); position=(unsigned char*)fmmap.data; + if (fmmap.size<10) Fatal("TFM file %s ends prematurely",tfmname); lh = UNumRead(position+2,2); bc = UNumRead(position+4,2); ec = UNumRead(position+6,2); nw = UNumRead(position+8,2); DEBUG_PRINT(DEBUG_TFM,(" %d %d %d %d",lh,bc,ec,nw)); if (nw>0) { + unsigned char *end=(unsigned char *) fmmap.data+fmmap.size; if ((width=malloc(nw*sizeof(dviunits)))==NULL) Fatal("cannot allocate memory for TFM widths"); c=0; position=position+24+(lh+ec-bc+1)*4; while( c < nw ) { + if (position >= end - 4) Fatal("TFM file %s ends prematurely",tfmname); width[c] = SNumRead(position,4); c++; position += 4; @@ -55,18 +58,23 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname) c=bc; position=(unsigned char*)fmmap.data+24+lh*4; while(c <= ec) { + if (position >= end) Fatal("TFM file %s ends prematurely",tfmname); DEBUG_PRINT(DEBUG_TFM,("\n@%ld TFM METRICS:\t", - (long)position - (long)fmmap.data)); + (long)((char *)position - fmmap.data))); if ((tcharptr=malloc(sizeof(struct char_entry)))==NULL) Fatal("cannot allocate memory for TFM char entry"); tcharptr->data=NULL; - tcharptr->tfmw=width[*position]; + if (*position < nw) { + tcharptr->tfmw=width[*position]; + } else { + Fatal("TFM file %s lacks width for char %u", tfmname, *position); + } DEBUG_PRINT(DEBUG_TFM,("%d [%d] %d",c,*position,tcharptr->tfmw)); tcharptr->tfmw = (dviunits) ((int64_t) tcharptr->tfmw * tfontp->s / (1 << 20)); DEBUG_PRINT(DEBUG_TFM,(" (%d)",tcharptr->tfmw)); if (c >= NFNTCHARS) /* Only positive for now */ - Fatal("tfm file %s exceeds char numbering limit",tfmname); + Fatal("tfm file %s exceeds char numbering limit %u",tfmname,NFNTCHARS); tfontp->chr[c] = tcharptr; c++; position += 4; |