From 38b8b40526a85f33521542e24d1e0c82588efc85 Mon Sep 17 00:00:00 2001 From: Behdad Esfahbod Date: Tue, 27 Aug 2013 11:44:09 -0400 Subject: [PATCH] Fix possible snprintf OOM https://bugzilla.redhat.com/show_bug.cgi?id=1001645 --- src/hb-buffer-serialize.cc | 14 +++++++------- src/hb-font-private.hh | 3 ++- src/hb-shape.cc | 6 +++--- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/src/hb-buffer-serialize.cc b/src/hb-buffer-serialize.cc index dc47ba73e..eac69000d 100644 --- a/src/hb-buffer-serialize.cc +++ b/src/hb-buffer-serialize.cc @@ -100,10 +100,10 @@ _hb_buffer_serialize_glyphs_json (hb_buffer_t *buffer, *p++ = '"'; } else - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint)); if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_CLUSTERS)) { - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), ",\"cl\":%u", info[i].cluster); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), ",\"cl\":%u", info[i].cluster)); } if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_POSITIONS)) @@ -161,21 +161,21 @@ _hb_buffer_serialize_glyphs_text (hb_buffer_t *buffer, p += strlen (p); } else - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint)); if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_CLUSTERS)) { - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "=%u", info[i].cluster); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "=%u", info[i].cluster)); } if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_POSITIONS)) { if (pos[i].x_offset || pos[i].y_offset) - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "@%d,%d", pos[i].x_offset, pos[i].y_offset); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "@%d,%d", pos[i].x_offset, pos[i].y_offset)); *p++ = '+'; - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%d", pos[i].x_advance); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%d", pos[i].x_advance)); if (pos->y_advance) - p += snprintf (p, ARRAY_LENGTH (b) - (p - b), ",%d", pos[i].y_advance); + p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), ",%d", pos[i].y_advance)); } if (buf_size > (p - b)) diff --git a/src/hb-font-private.hh b/src/hb-font-private.hh index acea1d724..2b9b544dd 100644 --- a/src/hb-font-private.hh +++ b/src/hb-font-private.hh @@ -426,7 +426,8 @@ struct hb_font_t { { if (get_glyph_name (glyph, s, size)) return; - snprintf (s, size, "gid%u", glyph); + if (size && snprintf (s, size, "gid%u", glyph) < 0) + *s = '\0'; } /* Parses gidDDD and uniUUUU strings automatically. */ diff --git a/src/hb-shape.cc b/src/hb-shape.cc index c28fdfa25..80d8c1306 100644 --- a/src/hb-shape.cc +++ b/src/hb-shape.cc @@ -181,18 +181,18 @@ hb_feature_to_string (hb_feature_t *feature, { s[len++] = '['; if (feature->start) - len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->start); + len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->start)); if (feature->end != feature->start + 1) { s[len++] = ':'; if (feature->end != (unsigned int) -1) - len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->end); + len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->end)); } s[len++] = ']'; } if (feature->value > 1) { s[len++] = '='; - len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->value); + len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->value)); } assert (len < ARRAY_LENGTH (s)); len = MIN (len, size - 1);