From 0545ec1ca36b27cb928128870a83e5f668980bc5 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Fri, 20 Mar 2009 06:49:10 +0100 Subject: [PATCH 1/2] Protect against invalid SID values in CFFs. Problem reported by Tavis Ormandy . * src/cff/cffload.c (cff_charset_load): Reject SID values larger than 64999. --- src/cff/cffload.c | 29 ++++++++++++++++++++++++++++- 2 files changed, 37 insertions(+), 1 deletions(-) diff --git a/src/cff/cffload.c b/src/cff/cffload.c index 22163fb..24b899d 100644 --- a/src/cff/cffload.c +++ b/src/cff/cffload.c @@ -842,7 +842,20 @@ goto Exit; for ( j = 1; j < num_glyphs; j++ ) - charset->sids[j] = FT_GET_USHORT(); + { + FT_UShort sid = FT_GET_USHORT(); + + + /* this constant is given in the CFF specification */ + if ( sid < 65000 ) + charset->sids[j] = sid; + else + { + FT_ERROR(( "cff_charset_load:" + " invalid SID value %d set to zero\n", sid )); + charset->sids[j] = 0; + } + } FT_FRAME_EXIT(); } @@ -875,6 +888,20 @@ goto Exit; } + /* check whether the range contains at least one valid glyph; */ + /* the constant is given in the CFF specification */ + if ( glyph_sid >= 65000 ) { + FT_ERROR(( "cff_charset_load: invalid SID range\n" )); + error = CFF_Err_Invalid_File_Format; + goto Exit; + } + + /* try to rescue some of the SIDs if `nleft' is too large */ + if ( nleft > 65000 - 1 || glyph_sid >= 65000 - nleft ) { + FT_ERROR(( "cff_charset_load: invalid SID range trimmed\n" )); + nleft = 65000 - 1 - glyph_sid; + } + /* Fill in the range of sids -- `nleft + 1' glyphs. */ for ( i = 0; j < num_glyphs && i <= nleft; i++, j++, glyph_sid++ ) charset->sids[j] = glyph_sid; -- 1.6.1.3.GIT From 0a05ba257b6ddd87dacf8d54b626e4b360e0a596 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Fri, 20 Mar 2009 07:19:45 +0100 Subject: [PATCH 2/2] Protect against malformed compressed data. Problem reported by Tavis Ormandy . * src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is zero. --- src/lzw/ftzopen.c | 3 +++ 2 files changed, 12 insertions(+), 0 deletions(-) diff --git a/src/lzw/ftzopen.c b/src/lzw/ftzopen.c index fc78315..c0483de 100644 --- a/src/lzw/ftzopen.c +++ b/src/lzw/ftzopen.c @@ -332,6 +332,9 @@ while ( code >= 256U ) { + if ( !state->prefix ) + goto Eof; + FTLZW_STACK_PUSH( state->suffix[code - 256] ); code = state->prefix[code - 256]; } -- 1.6.1.3.GIT