Reject caches when FcPattern isn't a constant.
This is usually unlikely to happen but reported.
I've decided to add more validation since this isn't reproducible
and easy to have a workaround rather than investigating 'why'.
https://bugs.freedesktop.org/show_bug.cgi?id=103237
Validation fails when the FcValueList contains more than font->num.
this logic was wrong because font->num contains a number of the elements
in FcPatternElt but FcValue in FcValueList.
This corrects 7a4a5bd7.
Patch from Tobias Stoeckmann
The cache files are insufficiently validated. Even though the magic
number at the beginning of the file as well as time stamps are checked,
it is not verified if contained offsets are in legal ranges or are
even pointers.
The lack of validation allows an attacker to trigger arbitrary free()
calls, which in turn allows double free attacks and therefore arbitrary
code execution. Due to the conversion from offsets into pointers through
macros, this even allows to circumvent ASLR protections.
This attack vector allows privilege escalation when used with setuid
binaries like fbterm. A user can create ~/.fonts or any other
system-defined user-private font directory, run fc-cache and adjust
cache files in ~/.cache/fontconfig. The execution of setuid binaries will
scan these files and therefore are prone to attacks.
If it's not about code execution, an endless loop can be created by
letting linked lists become circular linked lists.
This patch verifies that:
- The file is not larger than the maximum addressable space, which
basically only affects 32 bit systems. This allows out of boundary
access into unallocated memory.
- Offsets are always positive or zero
- Offsets do not point outside file boundaries
- No pointers are allowed in cache files, every "pointer or offset"
field must be an offset or NULL
- Iterating linked lists must not take longer than the amount of elements
specified. A violation of this rule can break a possible endless loop.
If one or more of these points are violated, the cache is recreated.
This is current behaviour.
Even though this patch fixes many issues, the use of mmap() shall be
forbidden in setuid binaries. It is impossible to guarantee with these
checks that a malicious user does not change cache files after
verification. This should be handled in a different patch.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Take a look at the nano second in the mtime to figure out
if the cache needs to be updated if available.
and do the mutex lock between scanning and writing a cache
to avoid the conflict.
Also we don't need to scan directories again after writing
caches. so getting rid of the related code as well.
https://bugs.freedesktop.org/show_bug.cgi?id=69845
and for reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1236034
config.h is read from fcint.h now so having a line of the sort of #include "config.h"
is duplicate.
Bug 69833 - Incorrect SIZEOF_VOID_P and ALIGNOF_DOUBLE definitions causes nasty warnings on MacOSX when building fat libraries
Add an ability to set the system root to generate the caches.
In order to do this, new APIs, FcConfigGetSysRoot() and
FcConfigSetSysRoot() is available.
X_OK checking was added back in 8ae1e3d5dc
which was removed due to the same reason in
238489030a.
apparently the test case in Bug#18934 still works without it.
so I'm removing it again to get this working on Windows.
Windows does not update mtime of directory on FAT filesystem when
file is added to it or removed from it. Fontconfig uses mtime of
directory to check cache file aging and hence fails to detect
newly added or recently removed files.
This changeset detects FAT filesystem (currently implemented for
Linux) and adds generating checksum of directory entries instead
of using mtime which guarantees proper cache rebuild.
For non-FAT filesystems this patch adds single syscall per directory
which is negligeable overhead.
This fixes bug https://bugs.freedesktop.org/show_bug.cgi?id=25535
Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
FcStat() logic is quite complicated in presence of various semi-broken operating
systems and filesystems, split it out in order to make it a bit easier.
Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Stop using mmap() if the cache file is stored on NFS.
also added FONTCONFIG_USE_MMAP environment variable to enforce the use of
or not the use of mmap(2) regardless of what the filesystem the cache files
are stored on.
Given that fontconfig will scan all of the cache file data during the
first font search, ask the kernel to start reading the pages right away.
Signed-off-by: Keith Packard <keithp@keithp.com>
This shouldn't affect the ABI, makes FcStat more like the rest of the
fontconfig API, and fixes warnings where we pass FcChar8* pointers in
to this func from other places.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Two changes:
- after mkdir(), we immediately chmod(), such that we are not affected
by stupid umask's.
- if a directory we want to use is not writable but exists, we try a
chmod on it. This is to recover from stupid umask's having affected
us with older versions.
Fix a couple of longstanding problems with fontconfig on Windows that
manifest themselves especially in GIMP. The root cause to the problems is in
Microsoft's incredibly stupid stat() implementation. Basically, stat()
returns wrong timestamp fields for files on NTFS filesystems on machines
that use automatic DST switching.
See for instance http://bugzilla.gnome.org/show_bug.cgi?id=154968 and
http://www.codeproject.com/datetime/dstbugs.asp
As fccache.c now looks at more fields in the stat struct I fill in them all.
I noticed that fstat() is used only on a fd just after opening it, so on
Win32 I just call my stat() replacement before opening instead...
Implementing a good replacement for fstat() would be harder because the code
in fccache.c wants to compare inode numbers. There are no (readily
accessible) inode numbers on Win32, so I fake it with the hash of the full
file name, in the case as it is on disk. And fstat() doesn't know the full
file name, so it would be rather hard to come up with a inode number to
identify the file.
The patch also adds similar handling for the cache directory as for the fonts
directory: If a cachedir element in fonts.conf contains the magic string
"WINDOWSTEMPDIR_FONTCONFIG_CACHE" it is replaced at runtime with a path under
the machine's (or user's) temp folder as returned by GetTempPath(). I don't
want to hardcode any pathnames in a fonts.conf intended to be distributed to
end-users, most of which who wouldn't know how to edit it anyway. And
requiring an installer to edit it gets complicated.
The cache was inserted into the hash table before the timestamps in the
cache were verified; if that verification failed, an extra pointer to the
now freed cache would be left in the hash table. FcFini would fail an
assertion as a result.
Some mingw versions have broken X_OK checking; instead of trying to work
around this in a system-depedent manner, simply don't bother checking for
X_OK along with W_OK as such cases are expected to be mistakes, and not
sensible access control.
Instead of relying on mtime ordering between a directory and its associated
cache file, write the directory mtime into the cache file itself. This makes
cache file checks more reliable across file systems.
This change is made in a way that old programs can use new cache files, but
new programs will need new cache files.
In FcDirCacheUnlink(), the line
cache_hashed = FcStrPlus (cache_dir, cache_base);
allocates memory in cache_hashed that is never free()'d before the function
exits.
Reported by Ben Combee.
src/fccache.c uses a trick to try and use a function name that is also a
macro name. It does this using the varargs args() macro. Replace that
with separate macros for each number of formals.
Our build system barfs on autogen.sh, which ignores --noconfigure. Configure
needs a host of options to make the cross compile work in our case.
Fix typo in fccache.c
FcStrCanonFileName checks whether s[0] == '/', and recurses if not.
This only works on POSIX. On dos, this crashes with a stack overflow.
The patch attached splits this functionality in two functions
(FcStrCanonAbsoluteFilename) and uses GetFullPathName on windows to get an
absolute path. It also fixes a number of other issues. With this patch,
LilyPond actually produces output on Windows.
All caches used in the application must be in the cache reference list so
internal references can be tracked correctly. Failing to have newly created
caches in the list would cause the cache to be deallocated while references
were still present.
Using a simple shell script that processes the public headers, two header
files are constructed that map public symbols to hidden internal aliases
avoiding the assocated PLT entry for referring to a public symbol.
A few mistakes in the FcPrivate/FcPublic annotations were also discovered
through this process
Eliminate need to reference cache object once per cached font, instead
just count the number of fonts used from the cache and bump the reference
count once by that amount. I think this makes this refernece technique
efficient enough for use.
Caches contain patterns and character sets which are reference counted and
visible to applications. Reference count the underlying cache object so that
it stays around until all reference objects are no longer in use.
This is less efficient than just leaving all caches around forever, but does
avoid eternal size increases in case applications ever bother to actually
look for changes in the font configuration.
Without reference counting on cache objects, there's no way to know when
an application is finished using objects pulled from the cache. Until some
kinf of cache reference counting can be done, leave all cache objects mapped
for the life of the library (until FcFini is called). To mitigate the cost
of this, ensure that each instance of a cache file is mapped only once.
Borrowing header stuff written for cairo, fontconfig now exposes in the
shared library only the symbols which are included in the public header
files. All private symbols are hidden using suitable compiler directives.
A few new public functions were required for the fontconfig utility programs
(fc-cat and fc-cache) so those were added, bumping the .so minor version number
in the process.
Use the version number inside the cache file to mark backward compatible
changes while continuing to reserve the filename number for incompatible
changes.
Instead of passing directory information around in separate variables,
collect it all in an FcCache structure. Numerous internal and tool
interfaces changed as a result of this.
Charsets are now pre-frozen before being serialized. This causes them to
share across multiple fonts in the same cache.
Automatically list all font directories when no arguments are given to
fc-cat. Also add -r option to recurse from specified cache directories.
fc-cat also now prints the cache filename in verbose mode, along with the
related directory name.
Validate cache contents and skip broken caches, looking down cache path for
valid ones.
Every time a directory is scanned, it will be written to a cache file if
possible, so fc-cache doesn't need to re-write the cache file. This makes
detecting when the cache was generated a bit tricky, so we guess that if the
cache wasn't valid before running and is valid afterwards, the cache file
was written.
Also, allow empty charsets to be serialized with null leaves/numbers.
Eliminate a leak in FcEdit by switching to FcObject sooner.
Call FcFini from fc-match to make valgrind happy.
FcCharSetSerialize was computing the offset to the unserialized leaf,
which left it pointing at random data when the cache was reloaded.
fc-cat has been updated to work with the new cache structure.
Various debug messages extended to help diagnose serialization errors.
Replace all of the bank/id pairs with simple offsets, recode several
data structures to always use offsets inside the library to avoid
conditional paths. Exposed data structures use pointers to hold offsets,
setting the low bit to distinguish between offset and pointer.
Use offset-based data structures for lang charset encodings; eliminates
separate data structure format for that file.
Much testing will be needed; offsets are likely not detected everywhere in
the library yet.
With the removal of the in-directory cache files, and the addition of
per-user cache directories, there is no longer any reason to preserve the
giant global cache file. Eliminating of this unifies the cache structure
and simplifies the overall caching strategies greatly.
Normalized directory names offer protection against looped directory trees
but cost enormous numbers of system calls (stat per file in the hierarchy).
Also, cache file directory name contents are validated each time the
directory is modified, don't re-validate every time the cache file is loaded
with an access and stat call.
Previous policy was to attempt to update the cache in place and bail if that
didn't work. Now, search for the first writable directory and place the
cache file there instead. Furthermore, on startup, search directory list for
valid cache files instead of bailing if the first found cache file wasn't
valid.
permitting cache files to be stored in font dirs. Bump cache magic.
Don't include /fonts.cache-2 in cache hash construction.
reviewed by: Patrick Lam <plam@mit.edu>
Akira TAGOH
Tobias Stoeckmann
Erik de Castro Lopo
Petr Filipsky
Patrick Haller
Behdad Esfahbod
Mikhail Gusarov
Keith Packard
Mike Frysinger
Serge van den Boom
Tor Lillqvist
Keith Packard
Keith Packard
Kean Johnston
Han-Wen Nienhuys
Patrick Lam