Ignore:
Timestamp:
Jun 30, 2008, 6:26:14 PM (13 years ago)
Author:
Eugene Romanenko
Message:

PDF plugin: freetype library updated to version 2.3.5

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/poppler/freetype2/src/otvalid/otvcommn.c

    r209 r251  
    55/*    OpenType common tables validation (body).                            */
    66/*                                                                         */
    7 /*  Copyright 2004, 2005, 2006 by                                          */
     7/*  Copyright 2004, 2005, 2006, 2007 by                                    */
    88/*  David Turner, Robert Wilhelm, and Werner Lemberg.                      */
    99/*                                                                         */
     
    4040  FT_LOCAL_DEF( void )
    4141  otv_Coverage_validate( FT_Bytes       table,
    42                          OTV_Validator  valid )
     42                         OTV_Validator  valid,
     43                         FT_Int         expected_count )
    4344  {
    4445    FT_Bytes  p = table;
    4546    FT_UInt   CoverageFormat;
     47    FT_UInt   total = 0;
    4648
    4749
     
    5860      {
    5961        FT_UInt  GlyphCount;
     62        FT_UInt  i;
    6063
    6164
     
    6568
    6669        OTV_LIMIT_CHECK( GlyphCount * 2 );        /* GlyphArray */
     70
     71        for ( i = 0; i < GlyphCount; ++i )
     72        {
     73          FT_UInt  gid;
     74
     75
     76          gid = FT_NEXT_USHORT( p );
     77          if ( gid >= valid->glyph_count )
     78            FT_INVALID_GLYPH_ID;
     79        }
     80
     81        total = GlyphCount;
    6782      }
    6883      break;
     
    7186      {
    7287        FT_UInt  n, RangeCount;
    73         FT_UInt  Start, End, StartCoverageIndex, total = 0, last = 0;
     88        FT_UInt  Start, End, StartCoverageIndex, last = 0;
    7489
    7590
     
    90105            FT_INVALID_DATA;
    91106
     107          if ( End >= valid->glyph_count )
     108            FT_INVALID_GLYPH_ID;
     109
    92110          if ( n > 0 && Start <= last )
    93111            FT_INVALID_DATA;
     
    103121    }
    104122
    105     /* no need to check glyph indices used as input to coverage tables */
    106     /* since even invalid glyph indices return a meaningful result     */
     123    /* Generally, a coverage table offset has an associated count field.  */
     124    /* The number of glyphs in the table should match this field.  If     */
     125    /* there is no associated count, a value of -1 tells us not to check. */
     126    if ( expected_count != -1 && (FT_UInt)expected_count != total )
     127      FT_INVALID_DATA;
    107128
    108129    OTV_EXIT;
     
    216237    case 1:     /* ClassDefFormat1 */
    217238      {
     239        FT_UInt  StartGlyph;
    218240        FT_UInt  GlyphCount;
    219241
    220242
    221         p += 2;         /* skip StartGlyph */
    222 
    223         OTV_LIMIT_CHECK( 2 );
    224 
     243        OTV_LIMIT_CHECK( 4 );
     244
     245        StartGlyph = FT_NEXT_USHORT( p );
    225246        GlyphCount = FT_NEXT_USHORT( p );
    226247
     
    228249
    229250        OTV_LIMIT_CHECK( GlyphCount * 2 );    /* ClassValueArray */
     251
     252        if ( StartGlyph + GlyphCount - 1 >= valid->glyph_count )
     253          FT_INVALID_GLYPH_ID;
    230254      }
    231255      break;
     
    253277            FT_INVALID_DATA;
    254278
     279          if ( End >= valid->glyph_count )
     280            FT_INVALID_GLYPH_ID;
     281
    255282          last = End;
    256283        }
     
    292319    DeltaFormat = FT_NEXT_USHORT( p );
    293320
    294     if ( DeltaFormat < 1 || DeltaFormat > 3 || EndSize < StartSize )
     321    if ( DeltaFormat < 1 || DeltaFormat > 3 )
     322      FT_INVALID_FORMAT;
     323
     324    if ( EndSize < StartSize )
    295325      FT_INVALID_DATA;
    296326
     
    331361    OTV_TRACE(( " (type %d)\n", LookupType ));
    332362
    333     if ( LookupType == 0 || LookupType >= valid->type_count )
     363    if ( LookupType == 0 || LookupType > valid->type_count )
    334364      FT_INVALID_DATA;
    335365
     
    658688    OTV_TRACE(( " (Count = %d)\n", Count ));
    659689
    660     otv_Coverage_validate( table + Coverage, valid );
     690    otv_Coverage_validate( table + Coverage, valid, Count );
    661691
    662692    OTV_LIMIT_CHECK( Count * 2 );
     
    730760
    731761    OTV_LIMIT_CHECK( ( Count1 - 1 ) * 2 + Count2 * 4 );
     762    p += ( Count1 - 1 ) * 2;
    732763
    733764    for ( ; Count2 > 0; Count2-- )
     
    825856    OTV_TRACE(( " (ClassSetCount = %d)\n", ClassSetCount ));
    826857
    827     otv_Coverage_validate( table + Coverage, valid );
     858    otv_Coverage_validate( table + Coverage, valid, -1 );
    828859    otv_ClassDef_validate( table + ClassDef, valid );
    829860
     
    873904
    874905    for ( count1 = GlyphCount; count1 > 0; count1-- )
    875       otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid );
     906      otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid, -1 );
    876907
    877908    for ( ; Count > 0; Count-- )
     
    914945    OTV_TRACE(( " (ChainClassSetCount = %d)\n", ChainClassSetCount ));
    915946
    916     otv_Coverage_validate( table + Coverage, valid );
     947    otv_Coverage_validate( table + Coverage, valid, -1 );
    917948
    918949    otv_ClassDef_validate( table + BacktrackClassDef,  valid );
     
    964995
    965996    for ( ; BacktrackGlyphCount > 0; BacktrackGlyphCount-- )
    966       otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid );
     997      otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid, -1 );
    967998
    968999    InputGlyphCount = FT_NEXT_USHORT( p );
     
    9731004
    9741005    for ( count1 = InputGlyphCount; count1 > 0; count1-- )
    975       otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid );
     1006      otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid, -1 );
    9761007
    9771008    LookaheadGlyphCount = FT_NEXT_USHORT( p );
     
    9821013
    9831014    for ( ; LookaheadGlyphCount > 0; LookaheadGlyphCount-- )
    984       otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid );
     1015      otv_Coverage_validate( table + FT_NEXT_USHORT( p ), valid, -1 );
    9851016
    9861017    count2 = FT_NEXT_USHORT( p );
Note: See TracChangeset for help on using the changeset viewer.