From b83d870b007f25b18e6b7a4ce2a417420d4dcb89 Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Fri, 9 Jun 2017 17:55:51 -0400 Subject: Fix types for FT_ULong chars in fpdfedittext MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit FXFT_Get_First(Next)_Char can return large unsigned values. This CL avoids integer overflow and adds some missing checks regarding the ranges of the values returned by those methods. Bug: chromium:727086 Change-Id: Ice7bbb3759e384b7174680a82a2a9380c3611382 Reviewed-on: https://pdfium-review.googlesource.com/6436 Commit-Queue: Nicolás Peña Reviewed-by: Lei Zhang --- fpdfsdk/fpdfedittext.cpp | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) (limited to 'fpdfsdk') diff --git a/fpdfsdk/fpdfedittext.cpp b/fpdfsdk/fpdfedittext.cpp index 3deae7ea20..1c3b22d7f3 100644 --- a/fpdfsdk/fpdfedittext.cpp +++ b/fpdfsdk/fpdfedittext.cpp @@ -231,6 +231,8 @@ CPDF_Stream* LoadUnicode(CPDF_Document* pDoc, std::move(pDict)); } +const uint32_t kMaxSimpleFontChar = 0xFF; + void* LoadSimpleFont(CPDF_Document* pDoc, std::unique_ptr pFont, const uint8_t* data, @@ -246,21 +248,23 @@ void* LoadSimpleFont(CPDF_Document* pDoc, fontDict->SetNewFor("BaseFont", name); uint32_t glyphIndex; - int currentChar = FXFT_Get_First_Char(pFont->GetFace(), &glyphIndex); - fontDict->SetNewFor("FirstChar", currentChar); + uint32_t currentChar = FXFT_Get_First_Char(pFont->GetFace(), &glyphIndex); + if (currentChar > kMaxSimpleFontChar || glyphIndex == 0) + return nullptr; + fontDict->SetNewFor("FirstChar", static_cast(currentChar)); CPDF_Array* widthsArray = pDoc->NewIndirect(); while (true) { widthsArray->AddNew(pFont->GetGlyphWidth(glyphIndex)); - int nextChar = + uint32_t nextChar = FXFT_Get_Next_Char(pFont->GetFace(), currentChar, &glyphIndex); // Simple fonts have 1-byte charcodes only. - if (nextChar > 0xff || glyphIndex == 0) + if (nextChar > kMaxSimpleFontChar || glyphIndex == 0) break; - for (int i = currentChar + 1; i < nextChar; i++) + for (uint32_t i = currentChar + 1; i < nextChar; i++) widthsArray->AddNew(0); currentChar = nextChar; } - fontDict->SetNewFor("LastChar", currentChar); + fontDict->SetNewFor("LastChar", static_cast(currentChar)); fontDict->SetNewFor("Widths", pDoc, widthsArray->GetObjNum()); CPDF_Dictionary* fontDesc = LoadFontDesc(pDoc, name, pFont.get(), data, size, font_type); @@ -270,6 +274,8 @@ void* LoadSimpleFont(CPDF_Document* pDoc, return pDoc->LoadFont(fontDict); } +const uint32_t kMaxUnicode = 0x10FFFF; + void* LoadCompositeFont(CPDF_Document* pDoc, std::unique_ptr pFont, const uint8_t* data, @@ -309,15 +315,15 @@ void* LoadCompositeFont(CPDF_Document* pDoc, fontDesc->GetObjNum()); uint32_t glyphIndex; - int currentChar = FXFT_Get_First_Char(pFont->GetFace(), &glyphIndex); + uint32_t currentChar = FXFT_Get_First_Char(pFont->GetFace(), &glyphIndex); // If it doesn't have a single char, just fail - if (glyphIndex == 0) + if (glyphIndex == 0 || currentChar > kMaxUnicode) return nullptr; std::map to_unicode; std::map widths; while (true) { - if (currentChar > 0x10FFFF) + if (currentChar > kMaxUnicode) break; widths[glyphIndex] = pFont->GetGlyphWidth(glyphIndex); -- cgit v1.2.3