diff options
Diffstat (limited to 'Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c')
-rw-r--r-- | Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c | 29 |
1 files changed, 23 insertions, 6 deletions
diff --git a/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c b/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c index e3449a0d13b..b650ebe8678 100644 --- a/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c +++ b/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c @@ -40,7 +40,7 @@ * http://www.microsoft.com/typography/specs/default.htm */ -#define _BSD_SOURCE /* for snprintf(), strdup() */ +#define _DEFAULT_SOURCE /* for snprintf(), strdup() */ #include "cairoint.h" #include "cairo-array-private.h" @@ -202,13 +202,17 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t *scaled_font_subset, if (unlikely (status)) goto fail1; - font->glyphs = calloc (font->num_glyphs_in_face + 1, sizeof (subset_glyph_t)); + /* Add 2: +1 case font does not contain .notdef, and +1 because an extra + * entry is required to contain the end location of the last glyph. + */ + font->glyphs = calloc (font->num_glyphs_in_face + 2, sizeof (subset_glyph_t)); if (unlikely (font->glyphs == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); goto fail1; } - font->parent_to_subset = calloc (font->num_glyphs_in_face, sizeof (int)); + /* Add 1 in case font does not contain .notdef */ + font->parent_to_subset = calloc (font->num_glyphs_in_face + 1, sizeof (int)); if (unlikely (font->parent_to_subset == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); goto fail2; @@ -247,7 +251,8 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t *scaled_font_subset, scaled_font_subset->subset_id); } - font->base.widths = calloc (font->num_glyphs_in_face, sizeof (int)); + /* Add 1 in case font does not contain .notdef */ + font->base.widths = calloc (font->num_glyphs_in_face + 1, sizeof (int)); if (unlikely (font->base.widths == NULL)) { status = _cairo_error (CAIRO_STATUS_NO_MEMORY); goto fail4; @@ -1420,6 +1425,12 @@ cleanup: return status; } +/* + * Sanity check on font name length as some broken fonts may return very long + * strings of garbage. 127 is maximum length of a PS name. + */ +#define MAX_FONT_NAME_LENGTH 127 + static cairo_status_t find_name (tt_name_t *name, int name_id, int platform, int encoding, int language, char **str_out) { @@ -1438,11 +1449,17 @@ find_name (tt_name_t *name, int name_id, int platform, int encoding, int languag be16_to_cpu (record->encoding) == encoding && (language == -1 || be16_to_cpu (record->language) == language)) { - str = malloc (be16_to_cpu (record->length) + 1); + len = be16_to_cpu (record->length); + if (platform == 3 && len > MAX_FONT_NAME_LENGTH*2) /* UTF-16 name */ + break; + + if (len > MAX_FONT_NAME_LENGTH) + break; + + str = malloc (len + 1); if (str == NULL) return _cairo_error (CAIRO_STATUS_NO_MEMORY); - len = be16_to_cpu (record->length); memcpy (str, ((char*)name) + be16_to_cpu (name->strings_offset) + be16_to_cpu (record->offset), len); |