[Git][freetype/freetype][master] [bzip2] Reset bzip stream on any error.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 6ee89519
  by Ben Wagner at 2022-01-13T08:21:36+01:00

  [bzip2] Reset bzip stream on any error.
  
  According to the bzip documentation it is undefined what will happen if
  `BZ2_bzDecompress` is called on a `bz_stream` it has previously returned an
  error against.  If `BZ2_bzDecompress` returns anything other than `BZ_OK`
  the only valid next action is `BZ2_bzDecompressEnd`.
  
  Reported as
  
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43564
  
  * src/bzip2/ftbzip2.c (FT_BZip2FileRec_): Add `reset` to track the need to
  reset the stream.
  (ft_bzip2_file_init): Initialize `reset` to 0.
  (ft_bzip2_file_reset): Set `reset` to 0 after resetting.
  (ft_bzip2_file_fill_output): Set `reset` to 1 when `BZ2_bzDecompress`
  returns anything other than `BZ_OK`.
  

1 changed file:

• src/bzip2/ftbzip2.c

Changes:

src/bzip2/ftbzip2.c

---

...	...	@@ -102,10 +102,11 @@
102	102
103	103	FT_Byte input[FT_BZIP2_BUFFER_SIZE]; /* input read buffer */
104	104
105		- FT_Byte buffer[FT_BZIP2_BUFFER_SIZE]; /* output buffer */
106		- FT_ULong pos; /* position in output */
	105	+ FT_Byte buffer[FT_BZIP2_BUFFER_SIZE]; /* output buffer */
	106	+ FT_ULong pos; /* position in output */
107	107	FT_Byte* cursor;
108	108	FT_Byte* limit;
	109	+ FT_Bool reset; /* reset before next read */
109	110
110	111	} FT_BZip2FileRec, *FT_BZip2File;
111	112
...	...	@@ -153,6 +154,7 @@
153	154	zip->limit = zip->buffer + FT_BZIP2_BUFFER_SIZE;
154	155	zip->cursor = zip->limit;
155	156	zip->pos = 0;
	157	+ zip->reset = 0;
156	158
157	159	/* check .bz2 header */
158	160	{
...	...	@@ -228,6 +230,7 @@
228	230	zip->limit = zip->buffer + FT_BZIP2_BUFFER_SIZE;
229	231	zip->cursor = zip->limit;
230	232	zip->pos = 0;
	233	+ zip->reset = 0;
231	234
232	235	BZ2_bzDecompressInit( bzstream, 0, 0 );
233	236	}
...	...	@@ -302,18 +305,23 @@
302	305
303	306	err = BZ2_bzDecompress( bzstream );
304	307
305		- if ( err == BZ_STREAM_END )
	308	+ if ( err != BZ_OK )
306	309	{
307		- zip->limit = (FT_Byte*)bzstream->next_out;
308		- if ( zip->limit == zip->cursor )
309		- error = FT_THROW( Invalid_Stream_Operation );
310		- break;
311		- }
312		- else if ( err != BZ_OK )
313		- {
314		- zip->limit = zip->cursor;
315		- error = FT_THROW( Invalid_Stream_Operation );
316		- break;
	310	+ zip->reset = 1;
	311	+
	312	+ if ( err == BZ_STREAM_END )
	313	+ {
	314	+ zip->limit = (FT_Byte*)bzstream->next_out;
	315	+ if ( zip->limit == zip->cursor )
	316	+ error = FT_THROW( Invalid_Stream_Operation );
	317	+ break;
	318	+ }
	319	+ else
	320	+ {
	321	+ zip->limit = zip->cursor;
	322	+ error = FT_THROW( Invalid_Stream_Operation );
	323	+ break;
	324	+ }
317	325	}
318	326	}
319	327
...	...	@@ -363,9 +371,9 @@
363	371	FT_Error error;
364	372
365	373
366		- /* Reset inflate stream if we're seeking backwards. */
367		- /* Yes, that is not too efficient, but it saves memory :-) */
368		- if ( pos < zip->pos )
	374	+ /* Reset inflate stream if seeking backwards or bzip reported an error. */
	375	+ /* Yes, that is not too efficient, but it saves memory :-) */
	376	+ if ( pos < zip->pos || zip->reset )
369	377	{
370	378	error = ft_bzip2_file_reset( zip );
371	379	if ( error )

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.