ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#513277199 Integer-overflow

Browse Source 
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I8a07f47f382502ab24670a270e8cd23a888f1ba4
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2656
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 6eb214dbe24ac7c1cde3fe8a6ce242f2d7e24151)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207713
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-07-07 14:29:51 +02:00
committed by Xisco Fauli
parent 3d55850014
commit 073913a2cc
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vcl/source/fontsubset/cff.cxx
+19
View File
@@ -1343,6 +1343,11 @@ private:
bool callType2Subr(bool bGlobal, int nSubrNumber);
sal_Int32 getReadOfs() const { return static_cast<sal_Int32>(mpReadPtr - mpBasePtr); }
// Abandon the current dict-data parse on malformed input. Advancing
// mpReadPtr past mpReadEnd exits the parse loop, and trips the mpReadPtr
// != mpReadEnd post-check so flags as a parse failure.
void abandonDictParse() { mpReadPtr = mpReadEnd + 1; }
const U8* mpBasePtr;
const U8* mpBaseEnd;
@@ -2453,6 +2458,8 @@ RealType CffContext::readRealVal()
int nExpSign = 0;
S64 nNumber = 0;
RealType fReal = +1.0;
// nNumber * 10 + 9 must fit in S64; anything beyond is a malformed
constexpr S64 nDigitCap = (SAL_MAX_INT64 - 9) / 10;
for (;;)
{
const U8 c = *(mpReadPtr++); // read nibbles
@@ -2460,6 +2467,12 @@ RealType CffContext::readRealVal()
const U8 nH = c >> 4U;
if (nH <= 9)
{
if (nNumber > nDigitCap)
{
SAL_WARN("vcl.fonts.cff", "CFF real number overflow");
abandonDictParse();
return 0.0;
}
nNumber = nNumber * 10 + nH;
--nExpVal;
}
@@ -2492,6 +2505,12 @@ RealType CffContext::readRealVal()
const U8 nL = c & 0x0F;
if (nL <= 9)
{
if (nNumber > nDigitCap)
{
SAL_WARN("vcl.fonts.cff", "CFF real number overflow");
abandonDictParse();
return 0.0;
}
nNumber = nNumber * 10 + nL;
--nExpVal;
}