From 4ee9d04bd5d518e5f1f86875f4f8184fc0552f44 Mon Sep 17 00:00:00 2001 From: Akira Kakuto Date: Fri, 3 Dec 2021 04:03:12 +0000 Subject: freetype 2.11.1 git-svn-id: svn://tug.org/texlive/trunk@61211 c570f23f-e606-0410-a88d-b1316a301751 --- .../libs/freetype2/freetype-src/src/cid/cidgload.c | 31 ++++---- .../libs/freetype2/freetype-src/src/cid/cidload.c | 92 +++++++++++----------- .../libs/freetype2/freetype-src/src/cid/cidload.h | 2 +- .../libs/freetype2/freetype-src/src/cid/cidobjs.c | 11 ++- .../libs/freetype2/freetype-src/src/cid/cidparse.c | 6 +- .../libs/freetype2/freetype-src/src/cid/cidparse.h | 2 +- 6 files changed, 74 insertions(+), 70 deletions(-) (limited to 'Build/source/libs/freetype2/freetype-src/src/cid') diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c index bd0a7e7fb10..a46d063dfeb 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidgload.c @@ -63,7 +63,7 @@ #endif - FT_TRACE1(( "cid_load_glyph: glyph index %d\n", glyph_index )); + FT_TRACE1(( "cid_load_glyph: glyph index %u\n", glyph_index )); #ifdef FT_CONFIG_OPTION_INCREMENTAL @@ -76,20 +76,17 @@ error = inc->funcs->get_glyph_data( inc->object, glyph_index, &glyph_data ); - if ( error ) + if ( error || glyph_data.length < cid->fd_bytes ) goto Exit; p = (FT_Byte*)glyph_data.pointer; - fd_select = cid_get_offset( &p, (FT_Byte)cid->fd_bytes ); + fd_select = cid_get_offset( &p, cid->fd_bytes ); - if ( glyph_data.length != 0 ) - { - glyph_length = (FT_ULong)( glyph_data.length - cid->fd_bytes ); + glyph_length = glyph_data.length - cid->fd_bytes; - if ( !FT_QALLOC( charstring, glyph_length ) ) - FT_MEM_COPY( charstring, glyph_data.pointer + cid->fd_bytes, - glyph_length ); - } + if ( !FT_QALLOC( charstring, glyph_length ) ) + FT_MEM_COPY( charstring, glyph_data.pointer + cid->fd_bytes, + glyph_length ); inc->funcs->free_glyph_data( inc->object, &glyph_data ); @@ -104,7 +101,7 @@ /* For ordinary fonts read the CID font dictionary index */ /* and charstring offset from the CIDMap. */ { - FT_UInt entry_len = (FT_UInt)( cid->fd_bytes + cid->gd_bytes ); + FT_UInt entry_len = cid->fd_bytes + cid->gd_bytes; FT_ULong off1, off2; @@ -114,15 +111,15 @@ goto Exit; p = (FT_Byte*)stream->cursor; - fd_select = cid_get_offset( &p, (FT_Byte)cid->fd_bytes ); - off1 = cid_get_offset( &p, (FT_Byte)cid->gd_bytes ); + fd_select = cid_get_offset( &p, cid->fd_bytes ); + off1 = cid_get_offset( &p, cid->gd_bytes ); p += cid->fd_bytes; - off2 = cid_get_offset( &p, (FT_Byte)cid->gd_bytes ); + off2 = cid_get_offset( &p, cid->gd_bytes ); FT_FRAME_EXIT(); - if ( fd_select >= (FT_ULong)cid->num_dicts || - off2 > stream->size || - off1 > off2 ) + if ( fd_select >= cid->num_dicts || + off2 > stream->size || + off1 > off2 ) { FT_TRACE0(( "cid_load_glyph: invalid glyph stream offsets\n" )); error = FT_THROW( Invalid_Offset ); diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c index 7fd0d7c78c2..496219de804 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.c @@ -41,7 +41,7 @@ /* read a single offset */ FT_LOCAL_DEF( FT_ULong ) cid_get_offset( FT_Byte* *start, - FT_Byte offsize ) + FT_UInt offsize ) { FT_ULong result; FT_Byte* p = *start; @@ -113,7 +113,7 @@ CID_FaceDict dict; - if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts ) + if ( parser->num_dict >= cid->num_dicts ) { FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n", keyword->ident )); @@ -164,7 +164,7 @@ FT_Fixed temp_scale; - if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts ) + if ( parser->num_dict < face->cid.num_dicts ) { FT_Matrix* matrix; FT_Vector* offset; @@ -244,11 +244,11 @@ FT_Memory memory = face->root.memory; FT_Stream stream = parser->stream; FT_Error error = FT_Err_Ok; - FT_Long num_dicts; + FT_Long num_dicts, max_dicts; num_dicts = cid_parser_to_int( parser ); - if ( num_dicts < 0 ) + if ( num_dicts < 0 || num_dicts > FT_INT_MAX ) { FT_ERROR(( "parse_fd_array: invalid number of dictionaries\n" )); goto Exit; @@ -272,18 +272,18 @@ * need a `dup X' at the very beginning and a `put' at the end, so a * rough guess using 100 bytes as the minimum is justified. */ - if ( (FT_ULong)num_dicts > stream->size / 100 ) + max_dicts = (FT_Long)( stream->size / 100 ); + if ( num_dicts > max_dicts ) { FT_TRACE0(( "parse_fd_array: adjusting FDArray size" " (from %ld to %ld)\n", - num_dicts, - stream->size / 100 )); - num_dicts = (FT_Long)( stream->size / 100 ); + num_dicts, max_dicts )); + num_dicts = max_dicts; } if ( !cid->font_dicts ) { - FT_Int n; + FT_UInt n; if ( FT_NEW_ARRAY( cid->font_dicts, num_dicts ) ) @@ -322,7 +322,7 @@ CID_FaceDict dict; - if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts ) + if ( parser->num_dict < face->cid.num_dicts ) { dict = face->cid.font_dicts + parser->num_dict; @@ -345,7 +345,7 @@ CID_Parser* parser ) { #ifdef FT_DEBUG_LEVEL_TRACE - if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts ) + if ( parser->num_dict < face->cid.num_dicts ) { T1_TokenRec token; FT_UInt len; @@ -427,7 +427,7 @@ parser->num_dict++; #ifdef FT_DEBUG_LEVEL_TRACE - FT_TRACE4(( " FontDict %d", parser->num_dict )); + FT_TRACE4(( " FontDict %u", parser->num_dict )); if ( parser->num_dict > face->cid.num_dicts ) FT_TRACE4(( " (ignored)" )); FT_TRACE4(( "\n" )); @@ -517,7 +517,7 @@ FT_Memory memory = face->root.memory; FT_Stream stream = face->cid_stream; FT_Error error; - FT_Int n; + FT_UInt n; CID_Subrs subr; FT_UInt max_offsets = 0; FT_ULong* offsets = NULL; @@ -559,13 +559,13 @@ } /* read the subrmap's offsets */ - if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) || - FT_FRAME_ENTER( ( num_subrs + 1 ) * (FT_UInt)dict->sd_bytes ) ) + if ( FT_STREAM_SEEK( cid->data_offset + dict->subrmap_offset ) || + FT_FRAME_ENTER( ( num_subrs + 1 ) * dict->sd_bytes ) ) goto Fail; p = (FT_Byte*)stream->cursor; for ( count = 0; count <= num_subrs; count++ ) - offsets[count] = cid_get_offset( &p, (FT_Byte)dict->sd_bytes ); + offsets[count] = cid_get_offset( &p, dict->sd_bytes ); FT_FRAME_EXIT(); @@ -594,7 +594,7 @@ goto Fail; if ( FT_STREAM_SEEK( cid->data_offset + offsets[0] ) || - FT_STREAM_READ( subr->code[0], data_len ) ) + FT_STREAM_READ( subr->code[0], data_len ) ) goto Fail; /* set up pointers */ @@ -771,12 +771,11 @@ CID_Parser* parser; FT_Memory memory = face->root.memory; FT_Error error; - FT_Int n; + FT_UInt n; CID_FaceInfo cid = &face->cid; FT_ULong binary_length; - FT_ULong entry_len; cid_init_loader( &loader, face ); @@ -805,7 +804,7 @@ face->root.stream->size - parser->data_offset ) { FT_TRACE0(( "cid_face_open: adjusting length of binary data\n" )); - FT_TRACE0(( " (from %ld to %ld bytes)\n", + FT_TRACE0(( " (from %lu to %lu bytes)\n", parser->binary_length, face->root.stream->size - parser->data_offset )); parser->binary_length = face->root.stream->size - @@ -833,10 +832,10 @@ /* sanity tests */ - if ( cid->fd_bytes < 0 || cid->gd_bytes < 1 ) + if ( cid->gd_bytes == 0 ) { FT_ERROR(( "cid_face_open:" - " Invalid `FDBytes' or `GDBytes' value\n" )); + " Invalid `GDBytes' value\n" )); error = FT_THROW( Invalid_File_Format ); goto Exit; } @@ -853,7 +852,24 @@ } binary_length = face->cid_stream->size - cid->data_offset; - entry_len = (FT_ULong)( cid->fd_bytes + cid->gd_bytes ); + + if ( cid->cidmap_offset > binary_length ) + { + FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Exit; + } + + /* the initial pre-check prevents the multiplication overflow */ + if ( cid->cid_count > FT_ULONG_MAX / 8 || + cid->cid_count * ( cid->fd_bytes + cid->gd_bytes ) > + binary_length - cid->cidmap_offset ) + { + FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Exit; + } + for ( n = 0; n < cid->num_dicts; n++ ) { @@ -879,8 +895,7 @@ dict->private_dict.blue_fuzz = 1; } - if ( dict->sd_bytes < 0 || - ( dict->num_subrs && dict->sd_bytes < 1 ) ) + if ( dict->num_subrs && dict->sd_bytes == 0 ) { FT_ERROR(( "cid_face_open: Invalid `SDBytes' value\n" )); error = FT_THROW( Invalid_File_Format ); @@ -903,11 +918,10 @@ goto Exit; } - /* `num_subrs' is scanned as a signed integer */ - if ( (FT_Int)dict->num_subrs < 0 || - ( dict->sd_bytes && - dict->num_subrs > ( binary_length - dict->subrmap_offset ) / - (FT_UInt)dict->sd_bytes ) ) + /* the initial pre-check prevents the multiplication overflow */ + if ( dict->num_subrs > FT_UINT_MAX / 4 || + dict->num_subrs * dict->sd_bytes > + binary_length - dict->subrmap_offset ) { FT_ERROR(( "cid_face_open: Invalid `SubrCount' value\n" )); error = FT_THROW( Invalid_File_Format ); @@ -915,22 +929,6 @@ } } - if ( cid->cidmap_offset > binary_length ) - { - FT_ERROR(( "cid_face_open: Invalid `CIDMapOffset' value\n" )); - error = FT_THROW( Invalid_File_Format ); - goto Exit; - } - - if ( entry_len && - cid->cid_count > - ( binary_length - cid->cidmap_offset ) / entry_len ) - { - FT_ERROR(( "cid_face_open: Invalid `CIDCount' value\n" )); - error = FT_THROW( Invalid_File_Format ); - goto Exit; - } - /* we can now safely proceed */ error = cid_read_subrs( face ); diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h index 456685c2af1..ee1d4865055 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidload.h @@ -37,7 +37,7 @@ FT_BEGIN_HEADER FT_LOCAL( FT_ULong ) cid_get_offset( FT_Byte** start, - FT_Byte offsize ); + FT_UInt offsize ); FT_LOCAL( FT_Error ) cid_face_open( CID_Face face, diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c index c7568118547..e3c29c22f67 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidobjs.c @@ -157,10 +157,14 @@ cid_size_request( FT_Size size, FT_Size_Request req ) { + FT_Error error; + PSH_Globals_Funcs funcs; - FT_Request_Metrics( size->face, req ); + error = FT_Request_Metrics( size->face, req ); + if ( error ) + goto Exit; funcs = cid_size_get_globals_funcs( (CID_Size)size ); @@ -170,7 +174,8 @@ size->metrics.y_scale, 0, 0 ); - return FT_Err_Ok; + Exit: + return error; } @@ -211,7 +216,7 @@ /* release subrs */ if ( face->subrs ) { - FT_Int n; + FT_UInt n; for ( n = 0; n < cid->num_dicts; n++ ) diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c index a28f8ee5590..852c9b6b965 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.c @@ -73,7 +73,11 @@ /* first of all, check the font format in the header */ if ( FT_FRAME_ENTER( 31 ) ) + { + FT_TRACE2(( " not a CID-keyed font\n" )); + error = FT_THROW( Unknown_File_Format ); goto Exit; + } if ( ft_strncmp( (char *)stream->cursor, "%!PS-Adobe-3.0 Resource-CIDFont", 31 ) ) @@ -181,7 +185,7 @@ parser->root.base = parser->postscript; parser->root.cursor = parser->postscript; parser->root.limit = parser->root.cursor + ps_len; - parser->num_dict = -1; + parser->num_dict = FT_UINT_MAX; /* Finally, we check whether `StartData' or `/sfnts' was real -- */ /* it could be in a comment or string. We also get the arguments */ diff --git a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h index 6a00c6cee12..fbc437bc380 100644 --- a/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h +++ b/Build/source/libs/freetype2/freetype-src/src/cid/cidparse.h @@ -78,7 +78,7 @@ FT_BEGIN_HEADER FT_ULong binary_length; CID_FaceInfo cid; - FT_Int num_dict; + FT_UInt num_dict; } CID_Parser; -- cgit v1.2.3