[Git][freetype/freetype][master] 3 commits: * tests/issue-1063/main.c: s

Alexei Podtelezhnikov pushed to branch master at FreeType / FreeType

Commits:

e990c33f

by Alexei Podtelezhnikov at 2021-10-20T11:27:03-04:00

* tests/issue-1063/main.c: s/PATH_MAX/FILENAME_MAX/.

Closes !97 for Windows by using a standard macro.

6d12e3a0

by Ben Wagner at 2021-10-20T11:38:16-04:00

[sfnt] Delay setting names and langTags until computed.

Previously, the table->names and table->langTags fields were created
pointing to uninitialized memory and an early exit could happen if the
frame could not be entered. The caller would then be unable to properly
dispose of the memory as the string fields had not been initialized.

Reported as
  https://bugs.chromium.org/p/chromium/issues/detail?id=1261343

* src/sfnt/ttload.c (tt_face_load_name): delay setting table->langTags
and table->names until after the memory they will point to is fully
initialized.

fde91ab8

by Ben Wagner at 2021-10-20T11:45:15-04:00

[sfnt] Delay setting gasp ranges and count until computed.

Previously, the gasp.numRanges was set and gasp.gaspRanges was
allocated and assigned before a possible early exit if the frame could
not be entered. It is also possible that the gaspRanges allocation
could fail but the numRanges still be set to non-zero. In such cases
an error would be returned, but the face would have a gasp in an
inconsistent state which may still be accessed.

Reported as
  https://bugs.chromium.org/p/chromium/issues/detail?id=1261450

* src/sfnt/ttload.c (tt_face_load_gasp): Delay setting gasp.numRanges
and gasp.gaspRanges until after the ranges are initialized.

Changes:

src/sfnt/ttload.c

@@ -837,6 +837,8 @@
      FT_ULong      table_pos, table_len;
      FT_ULong      storage_start, storage_limit;
      TT_NameTable  table;
 +    TT_Name       names = NULL;
 +    TT_LangTag    langTags = NULL;
      static const FT_Frame_Field  name_table_fields[] =
+     {
@@ -917,13 +919,13 @@
        storage_start += 2 + 4 * table->numLangTagRecords;
        /* allocate language tag records array */
 -      if ( FT_QNEW_ARRAY( table->langTags, table->numLangTagRecords ) ||
 -           FT_FRAME_ENTER( table->numLangTagRecords * 4 )             )
 +      if ( FT_QNEW_ARRAY( langTags, table->numLangTagRecords ) ||
 +           FT_FRAME_ENTER( table->numLangTagRecords * 4 )      )
          goto Exit;
        /* load language tags */
+       {
 -        TT_LangTag  entry = table->langTags;
 +        TT_LangTag  entry = langTags;
          TT_LangTag  limit = FT_OFFSET( entry, table->numLangTagRecords );
@@ -943,6 +945,9 @@
            /* mark the string as not yet loaded */
            entry->string = NULL;
+         }
++
 +        table->langTags = langTags;
 +        langTags = NULL;
+       }
        FT_FRAME_EXIT();
@@ -951,13 +956,13 @@
+     }
      /* allocate name records array */
 -    if ( FT_QNEW_ARRAY( table->names, table->numNameRecords ) ||
 -         FT_FRAME_ENTER( table->numNameRecords * 12 )         )
 +    if ( FT_QNEW_ARRAY( names, table->numNameRecords ) ||
 +         FT_FRAME_ENTER( table->numNameRecords * 12 )  )
        goto Exit;
      /* load name records */
+     {
 -      TT_Name  entry = table->names;
 +      TT_Name  entry = names;
        FT_UInt  count = table->numNameRecords;
        FT_UInt  valid = 0;
@@ -1000,9 +1005,11 @@
+       }
        /* reduce array size to the actually used elements */
 -      FT_MEM_QRENEW_ARRAY( table->names,
 +      FT_MEM_QRENEW_ARRAY( names,
                             table->numNameRecords,
                             valid );
 +      table->names = names;
 +      names = NULL;
        table->numNameRecords = valid;
+     }
@@ -1012,6 +1019,8 @@
      face->num_names = (FT_UShort)table->numNameRecords;
    Exit:
 +    FT_FREE( names );
 +    FT_FREE( langTags );
      return error;
+   }
@@ -1425,7 +1434,7 @@
      FT_Memory  memory = stream->memory;
      FT_UInt        j,num_ranges;
 -    TT_GaspRange   gaspranges = NULL;
 +    TT_GaspRange   gasp_ranges = NULL;
      /* the gasp table is optional */
@@ -1436,8 +1445,8 @@
      if ( FT_FRAME_ENTER( 4L ) )
        goto Exit;
 -    face->gasp.version   = FT_GET_USHORT();
 -    face->gasp.numRanges = FT_GET_USHORT();
 +    face->gasp.version = FT_GET_USHORT();
 +    num_ranges         = FT_GET_USHORT();
      FT_FRAME_EXIT();
@@ -1449,29 +1458,31 @@
        goto Exit;
+     }
 -    num_ranges = face->gasp.numRanges;
      FT_TRACE3(( "numRanges: %u\n", num_ranges ));
 -    if ( FT_QNEW_ARRAY( face->gasp.gaspRanges, num_ranges ) ||
 -         FT_FRAME_ENTER( num_ranges * 4L )                  )
 +    if ( FT_QNEW_ARRAY( gasp_ranges, num_ranges ) ||
 +         FT_FRAME_ENTER( num_ranges * 4L )        )
        goto Exit;
 -    gaspranges = face->gasp.gaspRanges;
+-
      for ( j = 0; j < num_ranges; j++ )
+     {
 -      gaspranges[j].maxPPEM  = FT_GET_USHORT();
 -      gaspranges[j].gaspFlag = FT_GET_USHORT();
 +      gasp_ranges[j].maxPPEM  = FT_GET_USHORT();
 +      gasp_ranges[j].gaspFlag = FT_GET_USHORT();
        FT_TRACE3(( "gaspRange %d: rangeMaxPPEM %5d, rangeGaspBehavior 0x%x\n",
                    j,
 -                  gaspranges[j].maxPPEM,
 -                  gaspranges[j].gaspFlag ));
 +                  gasp_ranges[j].maxPPEM,
 +                  gasp_ranges[j].gaspFlag ));
+     }
 +    face->gasp.gaspRanges = gasp_ranges;
 +    gasp_ranges = NULL;
 +    face->gasp.numRanges = num_ranges;
++
      FT_FRAME_EXIT();
    Exit:
 +    FT_FREE( gasp_ranges );
      return error;
+   }

tests/issue-1063/main.c

 -#include <limits.h>
  #include <stdio.h>
  #include <freetype/freetype.h>
@@ -19,7 +18,7 @@ main( void )
     * command-line.
     */
    const char*  testdata_dir = getenv( "FREETYPE_TESTS_DATA_DIR" );
 -  char         filepath[PATH_MAX];
 +  char         filepath[FILENAME_MAX];
    snprintf( filepath, sizeof( filepath ), "%s/%s",

From:	Alexei Podtelezhnikov (@apodtele)
Subject:	[Git][freetype/freetype][master] 3 commits: * tests/issue-1063/main.c: s/PATH_MAX/FILENAME_MAX/.
Date:	Wed, 20 Oct 2021 15:54:41 +0000