Verified Commit ecb6e58f authored by Emilio Cobos Álvarez's avatar Emilio Cobos Álvarez Committed by ma1
Browse files

Bug 2045617 - Add some bounds checks to cairo_cff_font_read_fdselect. a=dmeehan 

Attached to https://gitlab.freedesktop.org/cairo/cairo/-/work_items/967
as well.

Original Revision: https://phabricator.services.mozilla.com/D306604

Differential Revision: https://phabricator.services.mozilla.com/D310349
parent 8b53626f

gfx/cairo/cairo/src/cairo-cff-subset.c

+6 −0
Original line number Diff line number Diff line
@@ -978,11 +978,17 @@ cairo_cff_font_read_fdselect (cairo_cff_font_t *font, unsigned char *p) 
    type = *p++;

    if (type == 0)

    {

        if (p + font->num_glyphs > font->data_end)

            return CAIRO_INT_STATUS_UNSUPPORTED;

        for (i = 0; i < font->num_glyphs; i++)

            font->fdselect[i] = *p++;

    } else if (type == 3) {

        if (p + 2 > font->data_end)

            return CAIRO_INT_STATUS_UNSUPPORTED;

        num_ranges = get_unaligned_be16 (p);

        p += 2;

        if (p + (3 * num_ranges) + 2 > font->data_end)

            return CAIRO_INT_STATUS_UNSUPPORTED;

        for  (i = 0; i < num_ranges; i++)

        {

            first = get_unaligned_be16 (p);

gfx/cairo/patches/0035-cff-fdselect-bounds.patch

0 → 100644
+39 −0
Original line number Diff line number Diff line 
From a6e6e2ce22aa4a68ab816427ec765a107dd44673 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>

Date: Sat, 13 Jun 2026 16:44:33 +0200

Subject: [PATCH 2/3] [cff-subset] Add some missing bounds checks to

 cairo_cff_font_read_fdselect.

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



Signed-off-by: Emilio Cobos Álvarez <emilio@crisal.io>

---

 src/cairo-cff-subset.c | 6 ++++++

 1 file changed, 6 insertions(+)



diff --git a/src/cairo-cff-subset.c b/src/cairo-cff-subset.c

index 61ca4c459..64a059c3e 100644

--- a/src/cairo-cff-subset.c

+++ b/src/cairo-cff-subset.c

@@ -984,11 +984,17 @@ cairo_cff_font_read_fdselect (cairo_cff_font_t *font, unsigned char *p)

     type = *p++;

     if (type == 0)

     {

+        if (p + font->num_glyphs > font->data_end)

+            return CAIRO_INT_STATUS_UNSUPPORTED;

         for (i = 0; i < font->num_glyphs; i++)

             font->fdselect[i] = *p++;

     } else if (type == 3) {

+        if (p + 2 > font->data_end)

+            return CAIRO_INT_STATUS_UNSUPPORTED;

         num_ranges = get_unaligned_be16 (p);

         p += 2;

+        if (p + (3 * num_ranges) + 2 > font->data_end)

+            return CAIRO_INT_STATUS_UNSUPPORTED;

         for  (i = 0; i < num_ranges; i++)

         {

             first = get_unaligned_be16 (p);

-- 

2.54.0