bugThe FreeType Project - Bugs: bug #43153, Incorrect parsing of a type 1 font

 
 

bug #43153: Incorrect parsing of a type 1 font

Submitted by:  Dimitrios Papadopoulos <dipapado>
Submitted on:  Fri 05 Sep 2014 02:11:12 PM UTC  
 
Severity: 3 - NormalItem Group: Incorrect behaviour
Status: FixedPrivacy: Public
Assigned to: Alexei Podtelezhnikov <podtelez>Open/Closed: Closed
Planned Release: 2.5.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 09 Sep 2014 01:33:27 AM UTC, comment #5:

Fixed by commit bc12d9e9. Veryfied by Dimitros.

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Mon 08 Sep 2014 08:38:02 AM UTC, comment #4:

I believe that it belongs at the Postscript specification, of course plrm.pdf doesn't say anything about that, but many postscript interpreters and printers accept that.

Dimitrios Papadopoulos <dipapado>
Sun 07 Sep 2014 02:27:49 AM UTC, comment #3:

Thank you for correctly identifying the spot. Can you try this patch?

diff --git a/src/psaux/psconv.c b/src/psaux/psconv.c
index d0d8861..9443a50 100644
--- a/src/psaux/psconv.c
+++ b/src/psaux/psconv.c
@@ -250,7 +250,7 @@
if ( c < 0 || c >= 10 )
break;

- if ( decimal < 0xCCCCCCCL )
+ if ( divider < 0xCCCCCCCL && decimal < 0xCCCCCCCL )
{
decimal = decimal * 10 + c;

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Fri 05 Sep 2014 08:38:58 PM UTC, comment #2:

Type 1 Specifications seem to limit the numbers between -32000 and 32000. Nothing is said about the fractional part but the spirit of the law would suggest about the same five significant digits after the dot.

Given that we need to store the data in 16.16 format suggests the same. We ignore any accuracy beyond 1/65536 any way. So we might just drop anything beyond that.

/WeightVector [0.28894 0.11404 0.42803 0.16894] def

Werner?

P.S. Use %.5f when creating the font file.

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Fri 05 Sep 2014 05:49:39 PM UTC, comment #1:

It looks like the integer overflow, which seems to be controlled by `limit', which is perhaps set too high. Those first and third decimal parts are over FTLONG_MAX on 32-bit platforms.

Alexei Podtelezhnikov <podtelez>
Project MemberIn charge of this item.
Fri 05 Sep 2014 02:11:12 PM UTC, original submission:

The attached type1 font file is parsed wrongly.

More specific the values from the array
/WeightVector [0.2889404297 0.1140441895 0.4280395508 0.1689453125] def

are interpreted wrongly by the PS_Conv_ToFixed.

if ( decimal < 0xCCCCCCCL )
{
decimal = decimal * 10 + c;

if ( !integral && power_ten > 0 )
power_ten--;
else
divider *= 10;
}

Dimitrios Papadopoulos <dipapado>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #32030:  font1.pfb added by dipapado (72KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Updated the item)
  • -unavailable- added by podtelez (Posted a comment)
  • -unavailable- added by dipapado (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 21 Nov 2014 02:59:15 PM UTCwlAssigned toNone=>podtelez
      Planned ReleaseNone=>2.5.4
    Tue 09 Sep 2014 01:34:02 AM UTCpodtelezOpen/ClosedOpen=>Closed
    Tue 09 Sep 2014 01:33:27 AM UTCpodtelezStatusNone=>Fixed
    Fri 05 Sep 2014 02:11:12 PM UTCdipapadoAttached File-=>Added font1.pfb, #32030

    Back to the top


    Powered by Savane 3.1-cleanup1