[Git][freetype/freetype][master] [base] Fix ppem size overflow.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• f11f3ed1
  by Werner Lemberg at 2021-08-18T07:27:02+02:00

  [base] Fix ppem size overflow.
  
  Fixes #1086.
  
  * src/base/ftobjs.c (FT_Request_Metrics): Add return value.
  Check whether ppem values fit into unsigned short values.
  (FT_Request_Size): Updated.
  
  * include/freetype/internal/ftobjs.h: Updated.
  
  * src/cff/cffobjs.c (cff_size_request), src/cid/cidobjs.c
  (cid_size_request), src/truetype/ttdriver.c (tt_size_request),
  src/type1/t1objs.c (T1_Size_Request): Updated.
  

6 changed files:

• include/freetype/internal/ftobjs.h
• src/base/ftobjs.c
• src/cff/cffobjs.c
• src/cid/cidobjs.c
• src/truetype/ttdriver.c
• src/type1/t1objs.c

Changes:

include/freetype/internal/ftobjs.h

---

...	...	@@ -673,7 +673,7 @@ FT_BEGIN_HEADER
673	673
674	674
675	675	/* Set the metrics according to a size request. */
676		- FT_BASE( void )
	676	+ FT_BASE( FT_Error )
677	677	FT_Request_Metrics( FT_Face face,
678	678	FT_Size_Request req );
679	679

src/base/ftobjs.c

---

...	...	@@ -3132,10 +3132,12 @@
3132	3132	}
3133	3133
3134	3134
3135		- FT_BASE_DEF( void )
	3135	+ FT_BASE_DEF( FT_Error )
3136	3136	FT_Request_Metrics( FT_Face face,
3137	3137	FT_Size_Request req )
3138	3138	{
	3139	+ FT_Error error = FT_Err_Ok;
	3140	+
3139	3141	FT_Size_Metrics* metrics;
3140	3142
3141	3143
...	...	@@ -3226,8 +3228,18 @@
3226	3228	scaled_h = FT_MulFix( face->units_per_EM, metrics->y_scale );
3227	3229	}
3228	3230
3229		- metrics->x_ppem = (FT_UShort)( ( scaled_w + 32 ) >> 6 );
3230		- metrics->y_ppem = (FT_UShort)( ( scaled_h + 32 ) >> 6 );
	3231	+ scaled_w = ( scaled_w + 32 ) >> 6;
	3232	+ scaled_h = ( scaled_h + 32 ) >> 6;
	3233	+ if ( scaled_w > FT_USHORT_MAX ||
	3234	+ scaled_h > FT_USHORT_MAX )
	3235	+ {
	3236	+ FT_ERROR(( "FT_Request_Metrics: Resulting ppem size too large\n" ));
	3237	+ error = FT_ERR( Invalid_Pixel_Size );
	3238	+ goto Exit;
	3239	+ }
	3240	+
	3241	+ metrics->x_ppem = (FT_UShort)scaled_w;
	3242	+ metrics->y_ppem = (FT_UShort)scaled_h;
3231	3243
3232	3244	ft_recompute_scaled_metrics( face, metrics );
3233	3245	}
...	...	@@ -3237,6 +3249,9 @@
3237	3249	metrics->x_scale = 1L << 16;
3238	3250	metrics->y_scale = 1L << 16;
3239	3251	}
	3252	+
	3253	+ Exit:
	3254	+ return error;
3240	3255	}
3241	3256
3242	3257
...	...	@@ -3300,7 +3315,7 @@
3300	3315	FT_Request_Size( FT_Face face,
3301	3316	FT_Size_Request req )
3302	3317	{
3303		- FT_Error error = FT_Err_Ok;
	3318	+ FT_Error error;
3304	3319	FT_Driver_Class clazz;
3305	3320	FT_ULong strike_index;
3306	3321
...	...	@@ -3336,13 +3351,15 @@
3336	3351	*/
3337	3352	error = FT_Match_Size( face, req, 0, &strike_index );
3338	3353	if ( error )
3339		- return error;
	3354	+ goto Exit;
3340	3355
3341	3356	return FT_Select_Size( face, (FT_Int)strike_index );
3342	3357	}
3343	3358	else
3344	3359	{
3345		- FT_Request_Metrics( face, req );
	3360	+ error = FT_Request_Metrics( face, req );
	3361	+ if ( error )
	3362	+ goto Exit;
3346	3363
3347	3364	FT_TRACE5(( "FT_Request_Size:\n" ));
3348	3365	}
...	...	@@ -3365,6 +3382,7 @@
3365	3382	}
3366	3383	#endif
3367	3384
	3385	+ Exit:
3368	3386	return error;
3369	3387	}
3370	3388

src/cff/cffobjs.c

---

...	...	@@ -283,6 +283,8 @@
283	283	cff_size_request( FT_Size size,
284	284	FT_Size_Request req )
285	285	{
	286	+ FT_Error error;
	287	+
286	288	CFF_Size cffsize = (CFF_Size)size;
287	289	PSH_Globals_Funcs funcs;
288	290
...	...	@@ -304,7 +306,9 @@
304	306
305	307	#endif /* TT_CONFIG_OPTION_EMBEDDED_BITMAPS */
306	308
307		- FT_Request_Metrics( size->face, req );
	309	+ error = FT_Request_Metrics( size->face, req );
	310	+ if ( error )
	311	+ goto Exit;
308	312
309	313	funcs = cff_size_get_globals_funcs( cffsize );
310	314
...	...	@@ -345,7 +349,8 @@
345	349	}
346	350	}
347	351
348		- return FT_Err_Ok;
	352	+ Exit:
	353	+ return error;
349	354	}
350	355
351	356

src/cid/cidobjs.c

---

...	...	@@ -157,10 +157,14 @@
157	157	cid_size_request( FT_Size size,
158	158	FT_Size_Request req )
159	159	{
	160	+ FT_Error error;
	161	+
160	162	PSH_Globals_Funcs funcs;
161	163
162	164
163		- FT_Request_Metrics( size->face, req );
	165	+ error = FT_Request_Metrics( size->face, req );
	166	+ if ( error )
	167	+ goto Exit;
164	168
165	169	funcs = cid_size_get_globals_funcs( (CID_Size)size );
166	170
...	...	@@ -170,7 +174,8 @@
170	174	size->metrics.y_scale,
171	175	0, 0 );
172	176
173		- return FT_Err_Ok;
	177	+ Exit:
	178	+ return error;
174	179	}
175	180
176	181

src/truetype/ttdriver.c

---

...	...	@@ -354,7 +354,16 @@
354	354
355	355	#endif /* TT_CONFIG_OPTION_EMBEDDED_BITMAPS */
356	356
357		- FT_Request_Metrics( size->face, req );
	357	+ {
	358	+ FT_Error err = FT_Request_Metrics( size->face, req );
	359	+
	360	+
	361	+ if ( err )
	362	+ {
	363	+ error = err;
	364	+ goto Exit;
	365	+ }
	366	+ }
358	367
359	368	if ( FT_IS_SCALABLE( size->face ) )
360	369	{
...	...	@@ -382,6 +391,7 @@
382	391	#endif
383	392	}
384	393
	394	+ Exit:
385	395	return error;
386	396	}
387	397

src/type1/t1objs.c

---

...	...	@@ -116,11 +116,15 @@
116	116	T1_Size_Request( FT_Size t1size, /* T1_Size */
117	117	FT_Size_Request req )
118	118	{
	119	+ FT_Error error;
	120	+
119	121	T1_Size size = (T1_Size)t1size;
120	122	PSH_Globals_Funcs funcs = T1_Size_Get_Globals_Funcs( size );
121	123
122	124
123		- FT_Request_Metrics( size->root.face, req );
	125	+ error = FT_Request_Metrics( size->root.face, req );
	126	+ if ( error )
	127	+ goto Exit;
124	128
125	129	if ( funcs )
126	130	funcs->set_scale( (PSH_Globals)t1size->internal->module_data,
...	...	@@ -128,7 +132,8 @@
128	132	size->root.metrics.y_scale,
129	133	0, 0 );
130	134
131		- return FT_Err_Ok;
	135	+ Exit:
	136	+ return error;
132	137	}
133	138
134	139

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.