Attachment 15947 Details for Bug 49296

fontfile-sec_bufferoverflows.diff

fontfile-sec_bufferoverflows.diff (text/x-diff), 7.97 KB, created by Thomas Biege on 2004-02-12 18:19:02 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-02-12 18:19:02 UTC

Size: 7.97 KB

patch

obsolete

>diff -pru xc.bak/lib/font/fontfile/dirfile.c xc/lib/font/fontfile/dirfile.c
>--- xc.bak/lib/font/fontfile/dirfile.c	2002-05-31 20:45:50.000000000 +0200
>+++ xc/lib/font/fontfile/dirfile.c	2004-02-12 09:44:26.000000000 +0100
>@@ -68,6 +68,9 @@ FontFileReadDirectory (char *directory, 
> 
>     FontDirectoryPtr	dir = NullFontDirectory;
> 
>+    if (strlen(directory) + 1 + sizeof(FontDirFile) > sizeof(dir_file))
>+	return BadFontPath;
>+
> #ifdef FONTDIRATTRIB
>     /* Check for font directory attributes */
> #ifndef __UNIXOS2__
>@@ -154,6 +157,9 @@ FontFileDirectoryChanged(FontDirectoryPt
>     char	dir_file[MAXFONTFILENAMELEN];
>     struct stat	statb;
> 
>+    if (strlen(dir->directory) + sizeof(FontDirFile) > sizeof(dir_file))
>+	return FALSE;
>+
>     strcpy (dir_file, dir->directory);
>     strcat (dir_file, FontDirFile);
>     if (stat (dir_file, &statb) == -1)
>@@ -202,6 +208,8 @@ AddFileNameAliases(FontDirectoryPtr dir)
> 	    continue;
> 	
> 	len = strlen (fileName) - renderer->fileSuffixLen;
>+	if (len >= sizeof(copy))
>+	    continue;
> 	CopyISOLatin1Lowered (copy, fileName, len);
> 	copy[len] = '\0';
> 	name.name = copy;
>@@ -251,9 +259,13 @@ ReadFontAlias(char *directory, Bool isFi
>     int			status = Successful;
>     struct stat		statb;
> 
>+    if (strlen(directory) >= sizeof(alias_file))
>+	return BadFontPath;
>     dir = *pdir;
>     strcpy(alias_file, directory);
>     if (!isFile) {
>+	if (strlen(directory) + 1 + sizeof(FontAliasFile) > sizeof(alias_file))
>+	    return BadFontPath;
> 	if (directory[strlen(directory) - 1] != '/')
> 	    strcat(alias_file, "/");
> 	strcat(alias_file, FontAliasFile);
>@@ -286,6 +298,10 @@ ReadFontAlias(char *directory, Bool isFi
> 	    status = AllocError;
> 	    break;
> 	case NAME:
>+	    if (strlen(lexToken) >= sizeof(alias)) {
>+		status = BadFontPath;
>+		break;
>+	    }
> 	    strcpy(alias, lexToken);
> 	    token = lexAlias(file, &lexToken);
> 	    switch (token) {
>@@ -302,6 +318,10 @@ ReadFontAlias(char *directory, Bool isFi
> 		status = AllocError;
> 		break;
> 	    case NAME:
>+		if (strlen(lexToken) >= sizeof(font_name)) {
>+		    status = BadFontPath;
>+		    break;
>+		}
> 		CopyISOLatin1Lowered(alias, alias, strlen(alias));
> 		CopyISOLatin1Lowered(font_name, lexToken, strlen(lexToken));
> 		if (!FontFileAddFontAlias (dir, alias, font_name))
>diff -pru xc.bak/lib/font/fontfile/encparse.c xc/lib/font/fontfile/encparse.c
>--- xc.bak/lib/font/fontfile/encparse.c	2001-11-02 04:06:40.000000000 +0100
>+++ xc/lib/font/fontfile/encparse.c	2004-02-12 09:44:26.000000000 +0100
>@@ -833,6 +833,7 @@ FontEncReallyReallyLoad(const char *char
>     char file_name[MAXFONTFILENAMELEN], encoding_name[MAXFONTNAMELEN],
>         buf[MAXFONTFILENAMELEN];
>     int count, n;
>+    static char format[24] = "";
>     
>     /* As we don't really expect to open encodings that often, we don't
>        take the trouble of caching encodings directories. */
>@@ -848,8 +849,12 @@ FontEncReallyReallyLoad(const char *char
>     }
> 
>     encoding = NULL;
>+    if (!format[0]) {
>+	sprintf(format, "%%%ds %%%d[^\n]\n", sizeof(encoding_name) - 1,
>+		sizeof(file_name) - 1);
>+    }
>     for(;;) {
>-        count = fscanf(file, "%s %[^\n]\n", encoding_name, file_name);
>+        count = fscanf(file, format, encoding_name, file_name);
>         if(count == EOF)
>             break;
>         if(count != 2)
>diff -pru xc.bak/lib/font/fontfile/fontfile.c xc/lib/font/fontfile/fontfile.c
>--- xc.bak/lib/font/fontfile/fontfile.c	2002-05-31 20:45:50.000000000 +0200
>+++ xc/lib/font/fontfile/fontfile.c	2004-02-12 09:56:23.000000000 +0100
>@@ -341,7 +341,8 @@ FontFileOpenFont (pointer client, FontPa
> 	entry = FontFileFindNameInScalableDir (&dir->scalable, &tmpName, &vals);
> 	if (entry)
> 	{
>-	    strcpy(lowerName, entry->name.name);
>+	    strncpy(lowerName, entry->name.name, sizeof(lowerName)-1);
>+	    lowerName[sizeof(lowerName)-1] = '\0';
> 	    tmpName.name = lowerName;
> 	    tmpName.length = entry->name.length;
> 	    tmpName.ndashes = entry->name.ndashes;
>@@ -424,11 +425,16 @@ FontFileOpenFont (pointer client, FontPa
> 		    vals.ranges = ranges;
> 		    vals.nranges = nranges;
> 
>-		    strcpy (fileName, dir->directory);
>-		    strcat (fileName, scalable->fileName);
>-		    ret = (*scalable->renderer->OpenScalable) (fpe, pFont,
>+		    if (strlen(dir->directory) + strlen(scalable->fileName) >=
>+			sizeof(fileName)) {
>+			ret = BadFontName;
>+		    } else {
>+			strcpy (fileName, dir->directory);
>+			strcat (fileName, scalable->fileName);
>+			ret = (*scalable->renderer->OpenScalable) (fpe, pFont,
> 			   flags, entry, fileName, &vals, format, fmask,
> 			   non_cachable_font);
>+		    }
> 
> 		    /* In case rasterizer does something bad because of
> 		       charset subsetting... */
>@@ -497,6 +503,10 @@ FontFileOpenBitmapNCF (FontPathElementPt
> 
>     dir = (FontDirectoryPtr) fpe->private;
>     bitmap = &entry->u.bitmap;
>+    if(!bitmap || !bitmap->renderer->OpenBitmap)
>+	return BadFontName;
>+    if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName))
>+	return BadFontName;
>     strcpy (fileName, dir->directory);
>     strcat (fileName, bitmap->fileName);
>     ret = (*bitmap->renderer->OpenBitmap) 
>@@ -530,6 +540,10 @@ FontFileGetInfoBitmap (FontPathElementPt
> 
>     dir = (FontDirectoryPtr) fpe->private;
>     bitmap = &entry->u.bitmap;
>+    if (!bitmap || !bitmap->renderer->GetInfoBitmap)
>+	return BadFontName;
>+    if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName))
>+	return BadFontName;
>     strcpy (fileName, dir->directory);
>     strcat (fileName, bitmap->fileName);
>     ret = (*bitmap->renderer->GetInfoBitmap) (fpe, pFontInfo, entry, fileName);
>@@ -556,8 +570,9 @@ _FontFileAddScalableNames(FontNamesPtr n
> 	{
> 	    --*max;
> 
>-	    strcpy (nameChars, scaleNames->names[i]);
>-	    if ((vals->values_supplied & PIXELSIZE_MASK) ||
>+	   strncpy (nameChars, scaleNames->names[i], sizeof(nameChars)-1);
>+	   nameChars[sizeof(nameChars)-1] = '\0';
>+	   if ((vals->values_supplied & PIXELSIZE_MASK) ||
> 		!(vals->values_supplied & PIXELSIZE_WILDCARD) ||
> 		vals->y == 0)
> 	    {
>@@ -659,7 +674,7 @@ _FontFileListFonts (pointer client, Font
> 		    int mark_aliases)
> {
>     FontDirectoryPtr	dir;
>-    char		lowerChars[MAXFONTNAMELEN], zeroChars[MAXFONTNAMELEN];
>+    char		lowerChars[MAXFONTNAMELEN] = {0}, zeroChars[MAXFONTNAMELEN] = {0};
>     FontNameRec		lowerName;
>     FontNameRec		zeroName;
>     FontNamesPtr	scaleNames;
>@@ -679,7 +694,9 @@ _FontFileListFonts (pointer client, Font
> 
>     /* Match XLFD patterns */
> 
>-    strcpy (zeroChars, lowerChars);
>+    strncpy (zeroChars, lowerChars, sizeof(zeroChars)-1);
>+    zeroChars[sizeof(zeroChars)-1] = '\0';
>+    
>     if (lowerName.ndashes == 14 &&
> 	FontParseXLFDName (zeroChars, &vals, FONT_XLFD_REPLACE_ZERO))
>     {
>@@ -891,10 +908,16 @@ FontFileListOneFontWithInfo (pointer cli
> 		    vals.ranges = FontParseRanges(origName, &vals.nranges);
> 		    ranges = vals.ranges;
> 		    /* Make a new scaled instance */
>-	    	    strcpy (fileName, dir->directory);
>-	    	    strcat (fileName, scalable->fileName);
>-	    	    ret = (*scalable->renderer->GetInfoScalable)
>-			(fpe, *pFontInfo, entry, &tmpName, fileName, &vals);
>+
>+		    if (strlen(dir->directory) + strlen(scalable->fileName) >=
>+			sizeof(fileName)) {
>+			ret = BadFontName;
>+		    } else {
>+			strcpy (fileName, dir->directory);
>+			strcat (fileName, scalable->fileName);
>+			ret = (*scalable->renderer->GetInfoScalable)
>+			    (fpe, *pFontInfo, entry, &tmpName, fileName, &vals);
>+		    }
> 		    if (ranges) xfree(ranges);
> 		}
> 	    }
>@@ -931,10 +954,15 @@ FontFileListOneFontWithInfo (pointer cli
> 	    bc = &entry->u.bc;
> 	    entry = bc->entry;
> 	    /* Make a new scaled instance */
>-    	    strcpy (fileName, dir->directory);
>-    	    strcat (fileName, scalable->fileName);
>-	    ret = (*scalable->renderer->GetInfoScalable)
>+	    if (strlen(dir->directory) + strlen(scalable->fileName) >=
>+		sizeof(fileName)) {
>+		ret = BadFontName;
>+	    } else {
>+		strcpy (fileName, dir->directory);
>+		strcat (fileName, scalable->fileName);
>+		ret = (*scalable->renderer->GetInfoScalable)
> 		    (fpe, *pFontInfo, entry, tmpName, fileName, &bc->vals);
>+	    }
> 	    break;
> #endif
> 	default:

Actions: View

Attachments on bug 49296: 15852 | 15853 | 15854 | 15856 | 15857 | 15858 | 15860 | 15861 | 15925 | 15938 | 15939 | 15947 | 16168 | 16169 | 16180 | 16183 | 16184