ref: 75787c19eab20874c5d588842c52e59cfbd9302a
parent: ea5babaa67eeed68041a73933e0a7271960c0505
author: Werner Lemberg <[email protected]>
date: Sat Jun 26 05:24:08 EDT 2010
Add some memory checks (mainly for debugging). * src/base/ftstream.c (FT_Stream_EnterFrame): Exit with error if the frame size is larger than the stream size. * src/base/ftsystem.c (ft_ansi_stream_io): Exit with error if seeking a position larger than the stream size.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,15 @@
2010-06-25 Werner Lemberg <[email protected]>
+ Add some memory checks (mainly for debugging).
+
+ * src/base/ftstream.c (FT_Stream_EnterFrame): Exit with error
+ if the frame size is larger than the stream size.
+
+ * src/base/ftsystem.c (ft_ansi_stream_io): Exit with error if
+ seeking a position larger than the stream size.
+
+2010-06-25 Werner Lemberg <[email protected]>
+
Fix Savannah bug #30261.
* src/pfr/pfrobjs.c (pfr_face_init): Reject fonts which contain
--- a/include/freetype/ftsystem.h
+++ b/include/freetype/ftsystem.h
@@ -4,7 +4,7 @@
/* */
/* FreeType low-level system interface definition (specification). */
/* */
-/* Copyright 1996-2001, 2002, 2005 by */
+/* Copyright 1996-2001, 2002, 2005, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -240,7 +240,8 @@
*
* @note:
* This function might be called to perform a seek or skip operation
- * with a `count' of~0.
+ * with a `count' of~0. A non-zero return value then indicates an
+ * error.
*
*/
typedef unsigned long
--- a/src/base/ftstream.c
+++ b/src/base/ftstream.c
@@ -4,7 +4,7 @@
/* */
/* I/O stream support (body). */
/* */
-/* Copyright 2000-2001, 2002, 2004, 2005, 2006, 2008, 2009 by */
+/* Copyright 2000-2001, 2002, 2004, 2005, 2006, 2008, 2009, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -245,6 +245,18 @@
{/* allocate the frame in memory */
FT_Memory memory = stream->memory;
+
+
+ /* simple sanity check */
+ if ( count > stream->size )
+ {+ FT_ERROR(( "FT_Stream_EnterFrame:"
+ " frame size (%lu) larger than stream size (%lu)\n",
+ count, stream->size ));
+
+ error = FT_Err_Invalid_Stream_Operation;
+ goto Exit;
+ }
#ifdef FT_DEBUG_MEMORY
/* assume _ft_debug_file and _ft_debug_lineno are already set */
--- a/src/base/ftsystem.c
+++ b/src/base/ftsystem.c
@@ -4,7 +4,7 @@
/* */
/* ANSI-specific FreeType low-level system interface (body). */
/* */
-/* Copyright 1996-2001, 2002, 2006, 2008, 2009 by */
+/* Copyright 1996-2001, 2002, 2006, 2008, 2009, 2010 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
@@ -192,7 +192,9 @@
/* count :: The number of bytes to read from the stream. */
/* */
/* <Return> */
- /* The number of bytes actually read. */
+ /* The number of bytes actually read. If `count' is zero (this is, */
+ /* the function is used for seeking), a non-zero return value */
+ /* indicates an error. */
/* */
FT_CALLBACK_DEF( unsigned long )
ft_ansi_stream_io( FT_Stream stream,
@@ -202,6 +204,9 @@
{FT_FILE* file;
+
+ if ( !count && offset > stream->size )
+ return 1;
file = STREAM_FILE( stream );