ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz: check buffer bounds before reading multi-byte CFF dict operators

Browse Source 
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I434749e74e29f0aa3cda76746440af64cc2965dd
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2693
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 7263a6b61264ebf1bdfe01c27e2e6c53bee7687b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207732
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
This commit is contained in:
Caolán McNamara
2026-07-08 11:20:02 +02:00
committed by Xisco Fauli
parent f7b81f9789
commit f21dc6f83d
1 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vcl/source/fontsubset/cff.cxx
+29
View File
@@ -1519,6 +1519,12 @@ void CffContext::readDictOp()
pCmdName = pDictOps[nOpId];
else
{
if (mpReadPtr >= mpReadEnd)
{
SAL_WARN("vcl.fonts.cff", "truncated CFF dict op 12 escape");
abandonDictParse();
return;
}
const U8 nExtId = *(mpReadPtr++);
if (nExtId < 39)
pCmdName = pDictEscs[nExtId];
@@ -1702,6 +1708,12 @@ void CffContext::readDictOp()
else if (c == 29)
{ // longint
++mpReadPtr; // skip 29
if (mpReadPtr + 4 > mpReadEnd)
{
SAL_WARN("vcl.fonts.cff", "truncated CFF dict longint");
abandonDictParse();
return;
}
sal_Int32 nS32 = mpReadPtr[0] << 24;
nS32 += mpReadPtr[1] << 16;
nS32 += mpReadPtr[2] << 8;
@@ -1735,6 +1747,23 @@ void CffContext::read2push()
const U8*& p = mpReadPtr;
const U8 c = *p;
// total bytes consumed by this integer encoding, including the first
int nLen;
if (c == 28)
nLen = 3;
else if (c <= 246)
nLen = 1;
else if (c <= 254)
nLen = 2;
else
nLen = 5;
if (p + nLen > mpReadEnd)
{
SAL_WARN("vcl.fonts.cff", "truncated CFF dict integer (c=" << int(c) << ")");
abandonDictParse();
push(0);
return;
}
if (c == 28)
{
sal_Int16 nS16 = (p[1] << 8) + p[2];