[Git][freetype/freetype][master] [psaux] Full bounds check for OtherSubr 19.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 034e5dbf
  by Ben Wagner at 2022-02-23T17:42:55+01:00

  [psaux] Full bounds check for OtherSubr 19.
  
  It is possible for OtherSubr 19 to be invoked when `decoder->buildchar` is
  NULL (so that `decoder->len_buildchar` is 0), the `blend` is non-NULL with
  `blend->num_designs` set to 2, and the user supplied `idx` to be large (for
  example 0xFFFFFFFE).  Since these are all `FT_UInt32` the existing bounds
  check overflows in a well defined manner, allowing for an invalid call to
  `memcpy`.
  
  In addition, it is possible to call OtherSubr 19 with
  `decoder->len_buildchar`, `blend->num_designs`, and `idx` all zero (implying
  that `blend->weight_vector` and `decoder->buildchar` are NULL).  This passes
  the bounds check (it is logically always fine to copy nothing starting at
  index zero) but may invoke undefined behavior in `ft_memcpy` if it is backed
  by `memcpy`.  Calling `memcpy` with either the `src` or `dst` NULL is
  undefined behavior (even if `count` is zero).
  
  * src/psaux/psintrp.c (cf2_interpT2CharString): Correctly check that
  `blend->num_designs` can be copied to `decoder->buildchar[idx]`.
  Also avoid passing NULL to `ft_memcpy`.
  
  Bug: https://crbug.com/1299259
  

1 changed file:

• src/psaux/psintrp.c

Changes:

src/psaux/psintrp.c

---

...	...	@@ -1900,7 +1900,8 @@
1900	1900	/* WeightVector */
1901	1901	{
1902	1902	FT_UInt idx;
1903		- PS_Blend blend = decoder->blend;
	1903	+ PS_Blend blend = decoder->blend;
	1904	+ FT_UInt len_buildchar = decoder->len_buildchar;
1904	1905
1905	1906
1906	1907	if ( arg_cnt != 1 || !blend )
...	...	@@ -1908,14 +1909,15 @@
1908	1909
1909	1910	idx = (FT_UInt)cf2_stack_popInt( opStack );
1910	1911
1911		- if ( idx + blend->num_designs >
1912		- decoder->len_buildchar )
	1912	+ if ( len_buildchar < blend->num_designs ||
	1913	+ len_buildchar - blend->num_designs < idx )
1913	1914	goto Unexpected_OtherSubr;
1914	1915
1915		- ft_memcpy( &decoder->buildchar[idx],
1916		- blend->weight_vector,
1917		- blend->num_designs *
1918		- sizeof ( blend->weight_vector[0] ) );
	1916	+ if ( decoder->buildchar && blend->weight_vector )
	1917	+ ft_memcpy( &decoder->buildchar[idx],
	1918	+ blend->weight_vector,
	1919	+ blend->num_designs *
	1920	+ sizeof ( blend->weight_vector[0] ) );
1919	1921	}
1920	1922	break;
1921	1923

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.