bugm17n - Bugs: bug #50091, potential buffer-overrun in...

 
 

bug #50091: potential buffer-overrun in src/font.c: line 1368

Submitter:  Kazuhiko Maekawa <kmaekawa>
Submitted:  Thu 19 Jan 2017 10:48:29 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 08 Dec 2017 03:21:23 PM UTC, comment #1: 

Thank you for finding this bug.  I've just committed this fix.

diff --git a/src/font.c b/src/font.c
index 1136926..c0f748d 100644
--- a/src/font.c
+++ b/src/font.c
@@ -1362,9 +1362,11 @@ mfont__set_spec_from_plist (MFont *spec, MPlist *plist)
   for (i = 0; ! MPLIST_TAIL_P (plist); i++, plist = MPLIST_NEXT (plist))
     {
       if (! MPLIST_SYMBOL_P (plist))
- MERROR (MERROR_FONT, Mnil);
+ MERROR (MERROR_FONT, Mnil);
       spec_list[i] = MPLIST_SYMBOL (plist);
     }
+  if (i == 0)
+    MERROR (MERROR_FONT, Mnil);
   registry = spec_list[i - 1];
   if (i > 1 && registry != Mnil)
     {

Kenichi Handa <handa>
Group administrator
Thu 19 Jan 2017 10:48:29 AM UTC, original submission:  

The following code in font.c could make buffer-overrun when the
plist size is zero.

  mfont__set_spec_from_plist() in font.c: line 1368
  -------------------------------------------------
    for (i = 0; ! MPLIST_TAIL_P (plist); i++, plist = MPLIST_NEXT (plist))
    {
      if (! MPLIST_SYMBOL_P (plist))
    MERROR (MERROR_FONT, Mnil);
      spec_list[i] = MPLIST_SYMBOL (plist);
    }
  registry = spec_list[i - 1];
  -------------------------------------------------

It looks that plist has data about "encoding" or "resize"
information defined in FONTENC.tbl or FONTSIZE.tbl which
are pointed in mdb.dir. When FONTENC.tbl/FONTSIZE.tbl have
no entry, the above code could make buffer-overrun.

Kazuhiko Maekawa <kmaekawa>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by handa (Posted a comment)
  • -email is unavailable- added by kmaekawa (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-12-08 handa StatusNone Fixed
    2017-12-08 handa Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code