Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dba02be

Browse files
authored
Merge pull request matplotlib#20629 from sauerburger/fix-out-of-bounds-read-ttconv
Add protection against out-of-bounds read in ttconv
2 parents e18701d + deefcba commit dba02be

File tree

3 files changed

+21228
-27
lines changed

3 files changed

+21228
-27
lines changed

extern/ttconv/pprdrv_tt.cpp

Lines changed: 30 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -757,33 +757,36 @@ void ttfont_sfnts(TTStreamWriter& stream, struct TTFONT *font)
757757
** Find the tables we want and store there vital
758758
** statistics in tables[].
759759
*/
760-
for (x=0; x < 9; x++ )
761-
{
762-
do
763-
{
764-
diff = strncmp( (char*)ptr, table_names[x], 4 );
765-
766-
if ( diff > 0 ) /* If we are past it. */
767-
{
768-
tables[x].length = 0;
769-
diff = 0;
770-
}
771-
else if ( diff < 0 ) /* If we haven't hit it yet. */
772-
{
773-
ptr += 16;
774-
}
775-
else if ( diff == 0 ) /* Here it is! */
776-
{
777-
tables[x].newoffset = nextoffset;
778-
tables[x].checksum = getULONG( ptr + 4 );
779-
tables[x].oldoffset = getULONG( ptr + 8 );
780-
tables[x].length = getULONG( ptr + 12 );
781-
nextoffset += ( ((tables[x].length + 3) / 4) * 4 );
782-
count++;
783-
ptr += 16;
784-
}
785-
}
786-
while (diff != 0);
760+
ULONG num_tables_read = 0; /* Number of tables read from the directory */
761+
for (x = 0; x < 9; x++) {
762+
do {
763+
if (num_tables_read < font->numTables) {
764+
/* There are still tables to read from ptr */
765+
diff = strncmp((char*)ptr, table_names[x], 4);
766+
767+
if (diff > 0) { /* If we are past it. */
768+
tables[x].length = 0;
769+
diff = 0;
770+
} else if (diff < 0) { /* If we haven't hit it yet. */
771+
ptr += 16;
772+
num_tables_read++;
773+
} else if (diff == 0) { /* Here it is! */
774+
tables[x].newoffset = nextoffset;
775+
tables[x].checksum = getULONG( ptr + 4 );
776+
tables[x].oldoffset = getULONG( ptr + 8 );
777+
tables[x].length = getULONG( ptr + 12 );
778+
nextoffset += ( ((tables[x].length + 3) / 4) * 4 );
779+
count++;
780+
ptr += 16;
781+
num_tables_read++;
782+
}
783+
} else {
784+
/* We've read the whole table directory already */
785+
/* Some tables couldn't be found */
786+
tables[x].length = 0;
787+
break; /* Proceed to next tables[x] */
788+
}
789+
} while (diff != 0);
787790

788791
} /* end of for loop which passes over the table directory */
789792

0 commit comments

Comments
 (0)