/* */
/* CID-keyed Type1 font loader (body). */
/* */
-/* Copyright 1996-2001, 2002, 2003, 2004, 2005, 2006, 2009 by */
+/* Copyright 1996-2006, 2009, 2011-2012 by */
/* David Turner, Robert Wilhelm, and Werner Lemberg. */
/* */
/* This file is part of the FreeType project, and may only be used, */
CID_FaceDict dict;
- if ( parser->num_dict < 0 )
+ if ( parser->num_dict < 0 || parser->num_dict >= cid->num_dicts )
{
FT_ERROR(( "cid_load_keyword: invalid use of `%s'\n",
keyword->ident ));
FT_CALLBACK_DEF( FT_Error )
- parse_font_matrix( CID_Face face,
- CID_Parser* parser )
+ cid_parse_font_matrix( CID_Face face,
+ CID_Parser* parser )
{
FT_Matrix* matrix;
FT_Vector* offset;
FT_Fixed temp_scale;
- if ( parser->num_dict >= 0 )
+ if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
{
dict = face->cid.font_dicts + parser->num_dict;
matrix = &dict->font_matrix;
CID_FaceDict dict;
- if ( parser->num_dict >= 0 )
+ if ( parser->num_dict >= 0 && parser->num_dict < face->cid.num_dicts )
{
dict = face->cid.font_dicts + parser->num_dict;
#include "cidtoken.h"
T1_FIELD_CALLBACK( "FDArray", parse_fd_array, 0 )
- T1_FIELD_CALLBACK( "FontMatrix", parse_font_matrix, 0 )
+ T1_FIELD_CALLBACK( "FontMatrix", cid_parse_font_matrix, 0 )
T1_FIELD_CALLBACK( "ExpansionFactor", parse_expansion_factor, 0 )
{ 0, T1_FIELD_LOCATION_CID_INFO, T1_FIELD_TYPE_NONE, 0, 0, 0, 0, 0, 0 }
FT_Byte* p;
+ /* Check for possible overflow. */
+ if ( num_subrs == FT_UINT_MAX )
+ {
+ error = CID_Err_Syntax_Error;
+ goto Fail;
+ }
+
/* reallocate offsets array if needed */
if ( num_subrs + 1 > max_offsets )
{
FT_UInt new_max = FT_PAD_CEIL( num_subrs + 1, 4 );
+ if ( new_max <= max_offsets )
+ {
+ error = CID_Err_Syntax_Error;
+ goto Fail;
+ }
+
if ( FT_RENEW_ARRAY( offsets, max_offsets, new_max ) )
goto Fail;
FT_FRAME_EXIT();
+ /* offsets must be ordered */
+ for ( count = 1; count <= num_subrs; count++ )
+ if ( offsets[count - 1] > offsets[count] )
+ goto Fail;
+
/* now, compute the size of subrs charstrings, */
/* allocate, and read them */
data_len = offsets[num_subrs] - offsets[0];
static void
- t1_init_loader( CID_Loader* loader,
- CID_Face face )
+ cid_init_loader( CID_Loader* loader,
+ CID_Face face )
{
FT_UNUSED( face );
}
- static void
- t1_done_loader( CID_Loader* loader )
+ static void
+ cid_done_loader( CID_Loader* loader )
{
CID_Parser* parser = &loader->parser;
FT_Error error;
- t1_init_loader( &loader, face );
+ cid_init_loader( &loader, face );
parser = &loader.parser;
error = cid_parser_new( parser, face->root.stream, face->root.memory,
error = cid_read_subrs( face );
Exit:
- t1_done_loader( &loader );
+ cid_done_loader( &loader );
return error;
}