[Git][freetype/freetype][master] 2 commits: [cff] Commit vstore data and regions on allocation.

[Alexei Podtelezhnikov (@apodtele)]

Alexei Podtelezhnikov pushed to branch master at FreeType / FreeType

Commits:

• b5e003f1
  by Ben Wagner at 2021-10-21T09:48:38-04:00

  [cff] Commit vstore data and regions on allocation.
  
  The vstore->regionCount and vstore->dataCount were read directly
  from the data. However, vstore->varRegionList and vstore->varData
  would still contain uninitialized entries with uninitialized
  pointers in the event of an error, leading to issues when attempting
  to clean up.
  
  Reportd as
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40104
  
  * src/cff/cffload.c (cff_vstore_load): Read the region and data counts
  into locals and update the vstore counts immediately after each entry
  becomes free-able.
  

• 65be4b21
  by Ben Wagner at 2021-10-21T09:55:28-04:00

  [mm] Delay setting blend weight and design position.
  
  Previously the `blend->weight_vector`, `blend->default_weight_vector`,
  and `blend->design_pos` were set early to allocated but uninitialized
  memory under the assumption that the memory would eventually be
  initialized. However, it is possible that some of the required
  keywords may not actually be present, leaving the memory uninitialized.
  This is different from a present but invalid table, which would produce
  an error.
  
  Reported as
    https://bugs.chromium.org/p/chromium/issues/detail?id=1261762
  
  * src/type1/t1load.c (t1_allocate_blend): Remove early allocation and
  initialization.
  (parse_blend_design_positions, parse_weight_vector): Parse into local
  and assign to blend if valid.
  (T1_Open_Face): Check that if a blend exists that it has the weight
  vector and design positions.
  

2 changed files:

• src/cff/cffload.c
• src/type1/t1load.c

Changes:

src/cff/cffload.c

---

...	...	@@ -1138,6 +1138,8 @@
1138	1138	{
1139	1139	FT_UInt vsOffset;
1140	1140	FT_UInt format;
	1141	+ FT_UInt dataCount;
	1142	+ FT_UInt regionCount;
1141	1143	FT_ULong regionListOffset;
1142	1144
1143	1145
...	...	@@ -1161,15 +1163,15 @@
1161	1163
1162	1164	/* read top level fields */
1163	1165	if ( FT_READ_ULONG( regionListOffset ) ||
1164		- FT_READ_USHORT( vstore->dataCount ) )
	1166	+ FT_READ_USHORT( dataCount ) )
1165	1167	goto Exit;
1166	1168
1167	1169	/* make temporary copy of item variation data offsets; */
1168	1170	/* we'll parse region list first, then come back */
1169		- if ( FT_QNEW_ARRAY( dataOffsetArray, vstore->dataCount ) )
	1171	+ if ( FT_QNEW_ARRAY( dataOffsetArray, dataCount ) )
1170	1172	goto Exit;
1171	1173
1172		- for ( i = 0; i < vstore->dataCount; i++ )
	1174	+ for ( i = 0; i < dataCount; i++ )
1173	1175	{
1174	1176	if ( FT_READ_ULONG( dataOffsetArray[i] ) )
1175	1177	goto Exit;
...	...	@@ -1178,13 +1180,14 @@
1178	1180	/* parse regionList and axisLists */
1179	1181	if ( FT_STREAM_SEEK( vsOffset + regionListOffset ) ||
1180	1182	FT_READ_USHORT( vstore->axisCount ) ||
1181		- FT_READ_USHORT( vstore->regionCount ) )
	1183	+ FT_READ_USHORT( regionCount ) )
1182	1184	goto Exit;
1183	1185
1184		- if ( FT_QNEW_ARRAY( vstore->varRegionList, vstore->regionCount ) )
	1186	+ vstore->regionCount = 0;
	1187	+ if ( FT_QNEW_ARRAY( vstore->varRegionList, regionCount ) )
1185	1188	goto Exit;
1186	1189
1187		- for ( i = 0; i < vstore->regionCount; i++ )
	1190	+ for ( i = 0; i < regionCount; i++ )
1188	1191	{
1189	1192	CFF_VarRegion* region = &vstore->varRegionList[i];
1190	1193
...	...	@@ -1192,6 +1195,9 @@
1192	1195	if ( FT_QNEW_ARRAY( region->axisList, vstore->axisCount ) )
1193	1196	goto Exit;
1194	1197
	1198	+ /* keep track of how many axisList to deallocate on error */
	1199	+ vstore->regionCount++;
	1200	+
1195	1201	for ( j = 0; j < vstore->axisCount; j++ )
1196	1202	{
1197	1203	CFF_AxisCoords* axis = &region->axisList[j];
...	...	@@ -1211,10 +1217,11 @@
1211	1217	}
1212	1218
1213	1219	/* use dataOffsetArray now to parse varData items */
1214		- if ( FT_QNEW_ARRAY( vstore->varData, vstore->dataCount ) )
	1220	+ vstore->dataCount = 0;
	1221	+ if ( FT_QNEW_ARRAY( vstore->varData, dataCount ) )
1215	1222	goto Exit;
1216	1223
1217		- for ( i = 0; i < vstore->dataCount; i++ )
	1224	+ for ( i = 0; i < dataCount; i++ )
1218	1225	{
1219	1226	CFF_VarData* data = &vstore->varData[i];
1220	1227
...	...	@@ -1236,6 +1243,9 @@
1236	1243	if ( FT_QNEW_ARRAY( data->regionIndices, data->regionIdxCount ) )
1237	1244	goto Exit;
1238	1245
	1246	+ /* keep track of how many regionIndices to deallocate on error */
	1247	+ vstore->dataCount++;
	1248	+
1239	1249	for ( j = 0; j < data->regionIdxCount; j++ )
1240	1250	{
1241	1251	if ( FT_READ_USHORT( data->regionIndices[j] ) )

src/type1/t1load.c

---

...	...	@@ -117,6 +117,9 @@
117	117	goto Exit;
118	118
119	119	blend->num_default_design_vector = 0;
	120	+ blend->weight_vector = NULL;
	121	+ blend->default_weight_vector = NULL;
	122	+ blend->design_pos[0] = NULL;
120	123
121	124	face->blend = blend;
122	125	}
...	...	@@ -130,14 +133,11 @@
130	133
131	134
132	135	/* allocate the blend `private' and `font_info' dictionaries */
133		- if ( FT_QNEW_ARRAY( blend->font_infos[1], num_designs ) ||
134		- FT_QNEW_ARRAY( blend->privates [1], num_designs ) ||
135		- FT_QNEW_ARRAY( blend->bboxes [1], num_designs ) ||
136		- FT_QNEW_ARRAY( blend->weight_vector, num_designs * 2 ) )
	136	+ if ( FT_QNEW_ARRAY( blend->font_infos[1], num_designs ) ||
	137	+ FT_QNEW_ARRAY( blend->privates [1], num_designs ) ||
	138	+ FT_QNEW_ARRAY( blend->bboxes [1], num_designs ) )
137	139	goto Exit;
138	140
139		- blend->default_weight_vector = blend->weight_vector + num_designs;
140		-
141	141	blend->font_infos[0] = &face->type1.font_info;
142	142	blend->privates [0] = &face->type1.private_dict;
143	143	blend->bboxes [0] = &face->type1.font_bbox;
...	...	@@ -164,21 +164,6 @@
164	164	blend->num_axis = num_axis;
165	165	}
166	166
167		- /* allocate the blend design pos table if needed */
168		- num_designs = blend->num_designs;
169		- num_axis = blend->num_axis;
170		- if ( num_designs && num_axis && blend->design_pos[0] == NULL )
171		- {
172		- FT_UInt n;
173		-
174		-
175		- if ( FT_QNEW_ARRAY( blend->design_pos[0], num_designs * num_axis ) )
176		- goto Exit;
177		-
178		- for ( n = 1; n < num_designs; n++ )
179		- blend->design_pos[n] = blend->design_pos[0] + num_axis * n;
180		- }
181		-
182	167	Exit:
183	168	return error;
184	169
...	...	@@ -872,12 +857,14 @@
872	857	{
873	858	T1_TokenRec design_tokens[T1_MAX_MM_DESIGNS];
874	859	FT_Int num_designs;
875		- FT_Int num_axis;
	860	+ FT_Int num_axis = 0; /* make compiler happy */
876	861	T1_Parser parser = &loader->parser;
877		-
	862	+ FT_Memory memory = face->root.memory;
878	863	FT_Error error = FT_Err_Ok;
879		- PS_Blend blend;
	864	+ FT_Fixed* design_pos[T1_MAX_MM_DESIGNS];
	865	+
880	866
	867	+ design_pos[0] = NULL;
881	868
882	869	/* get the array of design tokens -- compute number of designs */
883	870	T1_ToTokenArray( parser, design_tokens,
...	...	@@ -899,12 +886,10 @@
899	886	{
900	887	FT_Byte* old_cursor = parser->root.cursor;
901	888	FT_Byte* old_limit = parser->root.limit;
902		- FT_Int n;
	889	+ FT_Int n,nn;
	890	+ PS_Blend blend;
903	891
904	892
905		- blend = face->blend;
906		- num_axis = 0; /* make compiler happy */
907		-
908	893	FT_TRACE4(( " [" ));
909	894
910	895	for ( n = 0; n < num_designs; n++ )
...	...	@@ -937,7 +922,13 @@
937	922	(FT_UInt)num_axis );
938	923	if ( error )
939	924	goto Exit;
940		- blend = face->blend;
	925	+
	926	+ /* allocate a blend design pos table */
	927	+ if ( FT_QNEW_ARRAY( design_pos[0], num_designs * num_axis ) )
	928	+ goto Exit;
	929	+
	930	+ for ( nn = 1; nn < num_designs; nn++ )
	931	+ design_pos[nn] = design_pos[0] + num_axis * nn;
941	932	}
942	933	else if ( n_axis != num_axis )
943	934	{
...	...	@@ -955,8 +946,8 @@
955	946
956	947	parser->root.cursor = token2->start;
957	948	parser->root.limit = token2->limit;
958		- blend->design_pos[n][axis] = T1_ToFixed( parser, 0 );
959		- FT_TRACE4(( " %f", (double)blend->design_pos[n][axis] / 65536 ));
	949	+ design_pos[n][axis] = T1_ToFixed( parser, 0 );
	950	+ FT_TRACE4(( " %f", (double)design_pos[n][axis] / 65536 ));
960	951	}
961	952	FT_TRACE4(( "]" )) ;
962	953	}
...	...	@@ -965,9 +956,21 @@
965	956
966	957	loader->parser.root.cursor = old_cursor;
967	958	loader->parser.root.limit = old_limit;
	959	+
	960	+ /* a valid BlendDesignPosition has been parsed */
	961	+ blend = face->blend;
	962	+ if ( blend->design_pos[0] )
	963	+ FT_FREE( blend->design_pos[0] );
	964	+
	965	+ for ( n = 0; n < num_designs; n++ )
	966	+ {
	967	+ blend->design_pos[n] = design_pos[n];
	968	+ design_pos[n] = NULL;
	969	+ }
968	970	}
969	971
970	972	Exit:
	973	+ FT_FREE( design_pos[0] );
971	974	loader->parser.root.error = error;
972	975	}
973	976
...	...	@@ -1088,6 +1091,7 @@
1088	1091	T1_TokenRec design_tokens[T1_MAX_MM_DESIGNS];
1089	1092	FT_Int num_designs;
1090	1093	FT_Error error = FT_Err_Ok;
	1094	+ FT_Memory memory = face->root.memory;
1091	1095	T1_Parser parser = &loader->parser;
1092	1096	PS_Blend blend = face->blend;
1093	1097	T1_Token token;
...	...	@@ -1129,6 +1133,12 @@
1129	1133	goto Exit;
1130	1134	}
1131	1135
	1136	+ if ( !blend->weight_vector )
	1137	+ if ( FT_QNEW_ARRAY( blend->weight_vector, num_designs * 2 ) )
	1138	+ goto Exit;
	1139	+
	1140	+ blend->default_weight_vector = blend->weight_vector + num_designs;
	1141	+
1132	1142	old_cursor = parser->root.cursor;
1133	1143	old_limit = parser->root.limit;
1134	1144
...	...	@@ -2578,7 +2588,15 @@
2578	2588	( !face->blend->num_designs || !face->blend->num_axis ) )
2579	2589	T1_Done_Blend( face );
2580	2590
2581		- /* another safety check */
	2591	+ /* the font may have no valid WeightVector */
	2592	+ if ( face->blend && !face->blend->weight_vector )
	2593	+ T1_Done_Blend( face );
	2594	+
	2595	+ /* the font may have no valid BlendDesignPositions */
	2596	+ if ( face->blend && !face->blend->design_pos[0] )
	2597	+ T1_Done_Blend( face );
	2598	+
	2599	+ /* the font may have no valid BlendDesignMap */
2582	2600	if ( face->blend )
2583	2601	{
2584	2602	FT_UInt i;

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.