From c001a192af784a3e7aa680cc925a4f6fc8f5b502 Mon Sep 17 00:00:00 2001
From: Patrick Lam <plam@MIT.EDU>
Date: Wed, 19 Apr 2006 16:17:19 +0000
Subject: [PATCH] Bail gracefully if the cache file does not contain enough
 data.

---
 ChangeLog               |  5 +++++
 README                  | 23 +++++++++++++++++++++--
 configure.in            |  2 +-
 fontconfig/fontconfig.h |  2 +-
 src/fccache.c           | 19 ++++++++++++++++++-
 5 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 67d7387..5324745 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2006-04-19  Patrick Lam	 <plam@mit.edu>
+	* src/fccache.c (FcDirCacheConsume, FcCacheNextOffset):
+
+	Bail gracefully if the cache file does not contain enough data.
+
 2006-04-14  Patrick Lam  <plam@mit.edu>
 	* fonts.conf.in:
 
diff --git a/README b/README
index e9d2d4e..71b363c 100644
--- a/README
+++ b/README
@@ -1,11 +1,30 @@
 			Fontconfig
 	Font configuration and customization library
-		      Version 2.3.94
-		         2006-02-24
+		      Version 2.3.95
+		         2006-04-18
+
 
 Check INSTALL for compilation and installation instructions.
 Report bugs to https://bugs.freedesktop.org in the fontconfig module.
 
+2.3.95
+
+Match 'Standard Symbols L' for 'Symbol'.  Add URW fonts as aliases for
+all of the PostScript fonts.  (reported by Miguel Rodriguez).  Fix a
+number of Coverity defects (Frederic Crozat).  Speed up FcFontSort
+(fix suggested by Kenichi Handa).  Fix error with charsets.  Survive
+missing docbook2pdf.  Compile on HP-UX, AIX, SGI and Windows (Cygwin,
+MinGW).  Fix intel compiler warnings.  Fix multiarch support (don't
+destroy multiarch files!)  Require pkg-config.  (Thanks Behdad; better
+solution wanted for libxml2 detection!)  Fix typos in orth files and
+add orth for Lingala (reported by Denis Jacquerye).  Remove debian/
+directory.  Add a configuration file that disables hinting for the
+Lohit Gujarati font (since the hinting distorts some glyphs quite
+badly).  Sort directory entries while scanning them from disk;
+prevents Heisenbugs due to file ordering in a directory (due to Egmont
+Koblinger).  Fix Wine's problem with finding fonts.  (Reported by
+Bernhard Rosenkraenzer.)
+
 2.3.94
 
 fc-cat can take directories as input and creates old-style fonts.cache
diff --git a/configure.in b/configure.in
index cfaf102..884bbe8 100644
--- a/configure.in
+++ b/configure.in
@@ -33,7 +33,7 @@ dnl This is the package version number, not the shared library
 dnl version.  This same version number must appear in fontconfig/fontconfig.h
 dnl Yes, it is a pain to synchronize version numbers.  Unfortunately, it's
 dnl not possible to extract the version number here from fontconfig.h
-AM_INIT_AUTOMAKE(fontconfig, 2.3.94)
+AM_INIT_AUTOMAKE(fontconfig, 2.3.95)
 AM_MAINTAINER_MODE
 
 dnl libtool versioning
diff --git a/fontconfig/fontconfig.h b/fontconfig/fontconfig.h
index 218fb1d..2ddd42f 100644
--- a/fontconfig/fontconfig.h
+++ b/fontconfig/fontconfig.h
@@ -46,7 +46,7 @@ typedef int		FcBool;
 
 #define FC_MAJOR	2
 #define FC_MINOR	3
-#define FC_REVISION	94
+#define FC_REVISION	95
 
 #define FC_VERSION	((FC_MAJOR * 10000) + (FC_MINOR * 100) + (FC_REVISION))
 
diff --git a/src/fccache.c b/src/fccache.c
index 58f925d..c98c001 100644
--- a/src/fccache.c
+++ b/src/fccache.c
@@ -617,6 +617,10 @@ static int
 FcCacheNextOffset(off_t w)
 {
     static long pagesize = -1;
+
+    if (w == -1)
+        return w;
+
     if (pagesize == -1)
 #if defined (HAVE_SYSCONF)
 	pagesize = sysconf(_SC_PAGESIZE);
@@ -1164,7 +1168,7 @@ FcDirCacheConsume (int fd, const char * dir, FcFontSet *set, FcConfig *config)
 {
     FcCache metadata;
     void * current_dir_block;
-    off_t pos;
+    off_t pos, endpos;
 
     if (read(fd, &metadata, sizeof(FcCache)) != sizeof(FcCache))
 	return FcFalse;
@@ -1181,6 +1185,19 @@ FcDirCacheConsume (int fd, const char * dir, FcFontSet *set, FcConfig *config)
     }
 
     pos = FcCacheNextOffset (lseek(fd, 0, SEEK_CUR));
+
+    /* This is not failsafe (multi-arches can break it),
+     * but fd has got to have at least as many bytes as
+     * metadata.count, or something's going to go horribly wrong. */
+    if (pos == (off_t)-1)
+        return FcFalse;
+
+    endpos = lseek (fd, 0, SEEK_END);
+    if (endpos == (off_t)-1 || endpos - pos < metadata.count)
+        return FcFalse;
+    if (lseek (fd, pos, SEEK_SET) == -1)
+        return FcFalse;
+
 #if defined(HAVE_MMAP) || defined(__CYGWIN__)
     current_dir_block = mmap (0, metadata.count, 
 			      PROT_READ, MAP_SHARED, fd, pos);