walkero
/
harfbuzz
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fail blob creation if length overflows or is too large 

Fail if blob start plus length overflows; or if blob length
is greater than 2GB.  It takes a while for fonts to get to that
size.  In the mean time, it protects against bugs like this:

  http://www.icu-project.org/trac/ticket/11450

Also avoids some weird issues with 32bit vs 64bit systems
as we accept length as unsigned int.  As such, a length of
-1 will cause overflow on 32bit machines, but happily
accepted on a 64bit machine.  Avoid that.
This commit is contained in:
Behdad Esfahbod 2014-12-18 18:22:21 -08:00
parent d5a5052098
commit 7d5e7613ce
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/hb-blob.cc
View File

@ -102,7 +102,10 @@ hb_blob_create (const char *data,
{
hb_blob_t *blob;
if (!length || !(blob = hb_object_create<hb_blob_t> ())) {
if (!length ||
length >= 1u << 31 ||
data + length < data /* overflows */ ||
!(blob = hb_object_create<hb_blob_t> ())) {
if (destroy)
destroy (user_data);
return hb_blob_get_empty ();

3
test/api/test-blob.c
View File

@ -53,6 +53,9 @@ test_blob_empty (void)
g_assert (hb_blob_is_immutable (hb_blob_get_empty ()));
g_assert (hb_blob_get_empty () != NULL);
g_assert (hb_blob_get_empty () == hb_blob_create (NULL, 0, HB_MEMORY_MODE_READONLY, NULL, NULL));
g_assert (hb_blob_get_empty () == hb_blob_create ("asdf", 0, HB_MEMORY_MODE_READONLY, NULL, NULL));
g_assert (hb_blob_get_empty () == hb_blob_create (NULL, -1, HB_MEMORY_MODE_READONLY, NULL, NULL));
g_assert (hb_blob_get_empty () == hb_blob_create ("asdfg", -1, HB_MEMORY_MODE_READONLY, NULL, NULL));
blob = hb_blob_get_empty ();
g_assert (blob == hb_blob_get_empty ());