summaryrefslogtreecommitdiff
path: root/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c')
-rw-r--r--Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c29
1 files changed, 23 insertions, 6 deletions
diff --git a/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c b/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c
index e3449a0d13b..b650ebe8678 100644
--- a/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c
+++ b/Build/source/libs/cairo/cairo-src/src/cairo-truetype-subset.c
@@ -40,7 +40,7 @@
* http://www.microsoft.com/typography/specs/default.htm
*/
-#define _BSD_SOURCE /* for snprintf(), strdup() */
+#define _DEFAULT_SOURCE /* for snprintf(), strdup() */
#include "cairoint.h"
#include "cairo-array-private.h"
@@ -202,13 +202,17 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t *scaled_font_subset,
if (unlikely (status))
goto fail1;
- font->glyphs = calloc (font->num_glyphs_in_face + 1, sizeof (subset_glyph_t));
+ /* Add 2: +1 case font does not contain .notdef, and +1 because an extra
+ * entry is required to contain the end location of the last glyph.
+ */
+ font->glyphs = calloc (font->num_glyphs_in_face + 2, sizeof (subset_glyph_t));
if (unlikely (font->glyphs == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail1;
}
- font->parent_to_subset = calloc (font->num_glyphs_in_face, sizeof (int));
+ /* Add 1 in case font does not contain .notdef */
+ font->parent_to_subset = calloc (font->num_glyphs_in_face + 1, sizeof (int));
if (unlikely (font->parent_to_subset == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail2;
@@ -247,7 +251,8 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t *scaled_font_subset,
scaled_font_subset->subset_id);
}
- font->base.widths = calloc (font->num_glyphs_in_face, sizeof (int));
+ /* Add 1 in case font does not contain .notdef */
+ font->base.widths = calloc (font->num_glyphs_in_face + 1, sizeof (int));
if (unlikely (font->base.widths == NULL)) {
status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
goto fail4;
@@ -1420,6 +1425,12 @@ cleanup:
return status;
}
+/*
+ * Sanity check on font name length as some broken fonts may return very long
+ * strings of garbage. 127 is maximum length of a PS name.
+ */
+#define MAX_FONT_NAME_LENGTH 127
+
static cairo_status_t
find_name (tt_name_t *name, int name_id, int platform, int encoding, int language, char **str_out)
{
@@ -1438,11 +1449,17 @@ find_name (tt_name_t *name, int name_id, int platform, int encoding, int languag
be16_to_cpu (record->encoding) == encoding &&
(language == -1 || be16_to_cpu (record->language) == language)) {
- str = malloc (be16_to_cpu (record->length) + 1);
+ len = be16_to_cpu (record->length);
+ if (platform == 3 && len > MAX_FONT_NAME_LENGTH*2) /* UTF-16 name */
+ break;
+
+ if (len > MAX_FONT_NAME_LENGTH)
+ break;
+
+ str = malloc (len + 1);
if (str == NULL)
return _cairo_error (CAIRO_STATUS_NO_MEMORY);
- len = be16_to_cpu (record->length);
memcpy (str,
((char*)name) + be16_to_cpu (name->strings_offset) + be16_to_cpu (record->offset),
len);