bugThe FreeType Project - Bugs: bug #43676, Incompatible pointer cast and...

 
 

bug #43676: Incompatible pointer cast and usage in various cmap classes

Submitted by:  None
Submitted on:  Mon 24 Nov 2014 04:29:15 AM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: FixedPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: 2.5.4

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 24 Nov 2014 08:54:37 AM UTC, comment #1:

Patch applied to git, thanks!

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Mon 24 Nov 2014 04:29:15 AM UTC, original submission:

In cffcmap.c:104

FT_DEFINE_CMAP_CLASS(cff_cmap_encoding_class_rec,
sizeof ( CFF_CMapStdRec ),

(FT_CMap_InitFunc) cff_cmap_encoding_init,
(FT_CMap_DoneFunc) cff_cmap_encoding_done,
(FT_CMap_CharIndexFunc)cff_cmap_encoding_char_index,
(FT_CMap_CharNextFunc) cff_cmap_encoding_char_next,

NULL, NULL, NULL, NULL, NULL
)

cff_cmap_encoding_init is:
FT_CALLBACK_DEF( FT_Error )
cff_cmap_encoding_init( CFF_CMapStd cmap )

FT_CMap_InitFunc is:
typedef FT_Error
(*FT_CMap_InitFunc)( FT_CMap cmap,
FT_Pointer init_data );

Note that the number of parameters differs. Calling this function
results in undefined behavior.

ISO/IEC 9899:TC3 (Committee Draft eptermber 7, 2007)
6.5.2.2 Function calls
9 If the function is defined with a type that is not compatible with the
type (of the expression) pointed to by the expression that denotes the
called function, the behavior is undefined.

On certain platforms (c -> js with emscripten) this causes termination of
execution or invalid calls because in the emscripten implementation, function
pointers of different types are stored in different pointer arrays. Incorrect
pointer type here results in indexing of an incorrect array.

Similar suspicious casts exist for:
cff_cmap_unicode_init
t1_cmap_standard_init
t1_cmap_expert_init
t1_cmap_custom_init
t1_cmap_unicode_init
fnt_cmap_init
pfr_cmap_init

Proposed fix attached

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #32532:  0001-Don-t-cast-cmap-init-function-pointers-to-an-incompa.2.patch added by jarkkopoyry (4KiB - text/x-patch - Oops, the patch had one param name alignment (cosmetic) error, here's a proper patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by jarkkopoyry (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 24 Nov 2014 08:54:37 AM UTCwlStatusNone=>Fixed
      Assigned toNone=>wl
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>2.5.4
    Mon 24 Nov 2014 04:46:55 AM UTCjarkkopoyryAttached File-=>Added 0001-Don-t-cast-cmap-init-function-pointers-to-an-incompa.2.patch, #32532
    Mon 24 Nov 2014 04:29:15 AM UTCNoneAttached File-=>Added 0001-Don-t-cast-cmap-init-function-pointers-to-an-incompa.patch, #32531

    Back to the top


    Powered by Savane 3.1-cleanup1