Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2014 PDFium Authors. All rights reserved. | 1 // Copyright 2014 PDFium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com | 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com |
| 6 | 6 |
| 7 #include "../../../include/fxge/fx_ge.h" | 7 #include "../../../include/fxge/fx_ge.h" |
| 8 #include "../../../include/fxge/fx_freetype.h" | 8 #include "../../../include/fxge/fx_freetype.h" |
| 9 #include "text_int.h" | 9 #include "text_int.h" |
| 10 #define GET_TT_SHORT(w) (FX_WORD)(((w)[0] << 8) | (w)[1]) | 10 #define GET_TT_SHORT(w) (FX_WORD)(((w)[0] << 8) | (w)[1]) |
| (...skipping 1349 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1360 { | 1360 { |
| 1361 FXSYS_FILE* pFile = FXSYS_fopen(path, "rb"); | 1361 FXSYS_FILE* pFile = FXSYS_fopen(path, "rb"); |
| 1362 if (pFile == NULL) { | 1362 if (pFile == NULL) { |
| 1363 return; | 1363 return; |
| 1364 } | 1364 } |
| 1365 FXSYS_fseek(pFile, 0, FXSYS_SEEK_END); | 1365 FXSYS_fseek(pFile, 0, FXSYS_SEEK_END); |
| 1366 FX_DWORD filesize = FXSYS_ftell(pFile); | 1366 FX_DWORD filesize = FXSYS_ftell(pFile); |
| 1367 FX_BYTE buffer[16]; | 1367 FX_BYTE buffer[16]; |
| 1368 FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET); | 1368 FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET); |
| 1369 size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile); | 1369 size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile); |
| 1370 if (readCnt != 12) { | |
|
Lei Zhang
2015/04/17 00:34:10
Actually checking here to prevent uninit reads.
| |
| 1371 FXSYS_fclose(pFile); | |
| 1372 return; | |
| 1373 } | |
| 1374 | |
| 1370 if (GET_TT_LONG(buffer) == 0x74746366) { | 1375 if (GET_TT_LONG(buffer) == 0x74746366) { |
| 1371 FX_DWORD nFaces = GET_TT_LONG(buffer + 8); | 1376 FX_DWORD nFaces = GET_TT_LONG(buffer + 8); |
| 1372 FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4); | 1377 FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4); |
|
Tom Sepez
2015/04/17 16:20:17
no reason to believe this doesn't overflow.
Lei Zhang
2015/05/08 05:40:38
Done.
| |
| 1373 if (!offsets) { | 1378 if (!offsets) { |
| 1374 FXSYS_fclose(pFile); | 1379 FXSYS_fclose(pFile); |
| 1375 return; | 1380 return; |
| 1376 } | 1381 } |
| 1377 readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile); | 1382 readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile); |
| 1383 if (readCnt != nFaces * 4) { | |
| 1384 FXSYS_fclose(pFile); | |
| 1385 return; | |
| 1386 } | |
| 1378 for (FX_DWORD i = 0; i < nFaces; i ++) { | 1387 for (FX_DWORD i = 0; i < nFaces; i ++) { |
|
Tom Sepez
2015/04/17 16:20:16
Array bounds violation if overflow.
Lei Zhang
2015/05/08 05:40:38
Should be ok with an overflow check, right?
| |
| 1379 FX_LPBYTE p = offsets + i * 4; | 1388 FX_LPBYTE p = offsets + i * 4; |
| 1380 ReportFace(path, pFile, filesize, GET_TT_LONG(p)); | 1389 ReportFace(path, pFile, filesize, GET_TT_LONG(p)); |
| 1381 } | 1390 } |
| 1382 FX_Free(offsets); | 1391 FX_Free(offsets); |
| 1383 } else { | 1392 } else { |
| 1384 ReportFace(path, pFile, filesize, 0); | 1393 ReportFace(path, pFile, filesize, 0); |
| 1385 } | 1394 } |
| 1386 FXSYS_fclose(pFile); | 1395 FXSYS_fclose(pFile); |
| 1387 } | 1396 } |
| 1388 void CFX_FolderFontInfo::ReportFace(CFX_ByteString& path, FXSYS_FILE* pFile, FX_ DWORD filesize, FX_DWORD offset) | 1397 void CFX_FolderFontInfo::ReportFace(CFX_ByteString& path, FXSYS_FILE* pFile, FX_ DWORD filesize, FX_DWORD offset) |
| (...skipping 125 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1514 return FALSE; | 1523 return FALSE; |
| 1515 } | 1524 } |
| 1516 CFontFaceInfo* pFont = (CFontFaceInfo*)hFont; | 1525 CFontFaceInfo* pFont = (CFontFaceInfo*)hFont; |
| 1517 name = pFont->m_FaceName; | 1526 name = pFont->m_FaceName; |
| 1518 return TRUE; | 1527 return TRUE; |
| 1519 } | 1528 } |
| 1520 FX_BOOL CFX_FolderFontInfo::GetFontCharset(void* hFont, int& charset) | 1529 FX_BOOL CFX_FolderFontInfo::GetFontCharset(void* hFont, int& charset) |
| 1521 { | 1530 { |
| 1522 return FALSE; | 1531 return FALSE; |
| 1523 } | 1532 } |
| OLD | NEW |