Chromium Code Reviews| Index: core/src/fxge/ge/fx_ge_fontmap.cpp |
| diff --git a/core/src/fxge/ge/fx_ge_fontmap.cpp b/core/src/fxge/ge/fx_ge_fontmap.cpp |
| index 43b971ffc37db19aeb3f7e06c382b73efa4546f8..47611c5b311c9cf632813f7c5f8c6bc38691385f 100644 |
| --- a/core/src/fxge/ge/fx_ge_fontmap.cpp |
| +++ b/core/src/fxge/ge/fx_ge_fontmap.cpp |
| @@ -1367,6 +1367,11 @@ void CFX_FolderFontInfo::ScanFile(CFX_ByteString& path) |
| FX_BYTE buffer[16]; |
| FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET); |
| size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile); |
| + if (readCnt != 12) { |
|
Lei Zhang
2015/04/17 00:34:10
Actually checking here to prevent uninit reads.
|
| + FXSYS_fclose(pFile); |
| + return; |
| + } |
| + |
| if (GET_TT_LONG(buffer) == 0x74746366) { |
| FX_DWORD nFaces = GET_TT_LONG(buffer + 8); |
| FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4); |
|
Tom Sepez
2015/04/17 16:20:17
no reason to believe this doesn't overflow.
Lei Zhang
2015/05/08 05:40:38
Done.
|
| @@ -1375,6 +1380,10 @@ void CFX_FolderFontInfo::ScanFile(CFX_ByteString& path) |
| return; |
| } |
| readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile); |
| + if (readCnt != nFaces * 4) { |
| + FXSYS_fclose(pFile); |
| + return; |
| + } |
| for (FX_DWORD i = 0; i < nFaces; i ++) { |
|
Tom Sepez
2015/04/17 16:20:16
Array bounds violation if overflow.
Lei Zhang
2015/05/08 05:40:38
Should be ok with an overflow check, right?
|
| FX_LPBYTE p = offsets + i * 4; |
| ReportFace(path, pFile, filesize, GET_TT_LONG(p)); |