Verified Commit 51071b8f authored by Lee Salzman's avatar Lee Salzman Committed by ma1
Browse files

Bug 2045711. a=diannaS 

Original Revision: https://phabricator.services.mozilla.com/D311733

Differential Revision: https://phabricator.services.mozilla.com/D312888
parent 18daf32e

gfx/cairo/cairo/src/cairo-truetype-subset.c

+10 −1
Original line number Diff line number Diff line
@@ -1451,13 +1451,22 @@ find_name (tt_name_t *name, unsigned long size, int name_id, int platform, int e 
{

    tt_name_record_t *record;

    unsigned int i, len;

    unsigned long max_records;

    char *str;

    char *p;

    cairo_bool_t has_tag;

    cairo_status_t status;



    str = NULL;

    for (i = 0; i < MIN(be16_to_cpu (name->num_records), size / sizeof(name->records[0])); i++) {

    /* records[] starts after the 6-byte tt_name_t header (format,

     * num_records, strings_offset); only records lying entirely within the

     * size-byte table may be read. */

    if (size < offsetof (tt_name_t, records)) {

	*str_out = NULL;

	return CAIRO_STATUS_SUCCESS;

    }

    max_records = (size - offsetof (tt_name_t, records)) / sizeof(name->records[0]);

    for (i = 0; i < MIN(be16_to_cpu (name->num_records), max_records); i++) {

        record = &(name->records[i]);

	if (be16_to_cpu (record->name) == name_id &&

	    be16_to_cpu (record->platform) == platform &&

gfx/cairo/patches/0043-Bug-2045711-records-size-check.patch

0 → 100644
+37 −0
Original line number Diff line number Diff line 
diff --git a/gfx/cairo/cairo/src/cairo-truetype-subset.c b/gfx/cairo/cairo/src/cairo-truetype-subset.c

--- a/gfx/cairo/cairo/src/cairo-truetype-subset.c

+++ b/gfx/cairo/cairo/src/cairo-truetype-subset.c

@@ -1446,23 +1446,32 @@ cleanup:

  */

 #define MAX_FONT_NAME_LENGTH 127

 

 static cairo_status_t

 find_name (tt_name_t *name, unsigned long size, int name_id, int platform, int encoding, int language, char **str_out)

 {

     tt_name_record_t *record;

     unsigned int i, len;

+    unsigned long max_records;

     char *str;

     char *p;

     cairo_bool_t has_tag;

     cairo_status_t status;

 

     str = NULL;

-    for (i = 0; i < MIN(be16_to_cpu (name->num_records), size / sizeof(name->records[0])); i++) {

+    /* records[] starts after the 6-byte tt_name_t header (format,

+     * num_records, strings_offset); only records lying entirely within the

+     * size-byte table may be read. */

+    if (size < offsetof (tt_name_t, records)) {

+	*str_out = NULL;

+	return CAIRO_STATUS_SUCCESS;

+    }

+    max_records = (size - offsetof (tt_name_t, records)) / sizeof(name->records[0]);

+    for (i = 0; i < MIN(be16_to_cpu (name->num_records), max_records); i++) {

         record = &(name->records[i]);

 	if (be16_to_cpu (record->name) == name_id &&

 	    be16_to_cpu (record->platform) == platform &&

             be16_to_cpu (record->encoding) == encoding &&

 	    (language == -1 || be16_to_cpu (record->language) == language)) {

 

 	    len = be16_to_cpu (record->length);

 	    if (platform == 3 && len > MAX_FONT_NAME_LENGTH*2) /* UTF-16 name */