ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2025-06-20 08:03:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ttf_font: prevent out-of-bounds access

Browse Source 
Thanks Alexander Böttcher for investigating.

Fixes #3393
This commit is contained in:
Norman Feske
2019-06-04 12:18:16 +02:00
committed by Christian Helmuth
parent ff23d665c6
commit 7e174e73be
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
repos/gems/src/lib/ttf_font/ttf_font.cc
View File

@ -101,7 +101,9 @@ struct Ttf_font::Glyph_buffer
*/ */
size_t const capacity; size_t const capacity;
size_t _num_bytes() const { return capacity*sizeof(Opacity); } size_t const _headroom = 5;
size_t _num_bytes() const { return (capacity + _headroom)*sizeof(Opacity); }
Opacity * const _values = (Opacity *)alloc.alloc(_num_bytes()); Opacity * const _values = (Opacity *)alloc.alloc(_num_bytes());
@ -162,19 +164,22 @@ Ttf_font::Glyph_buffer::render_shifted(Codepoint const c,
if (y0 < -(int)baseline) if (y0 < -(int)baseline)
y0 = -(int)baseline; y0 = -(int)baseline;
/* x0 may be negative, clamp its lower bound to headroom of the buffer */
x0 = Genode::max(-(int)_headroom, x0);
unsigned const dx = x1 - x0; unsigned const dx = x1 - x0;
unsigned const dy = y1 - y0; unsigned const dy = y1 - y0;
unsigned const width = dx + 1 + PAD_X; unsigned const width = dx + 1 + PAD_X;
unsigned const height = dy + 1 + PAD_Y; unsigned const height = dy + 1 + PAD_Y;
unsigned const dst_width = filter_x*width; unsigned const dst_width = filter_x*width;
unsigned char * const dst_ptr = (unsigned char *)_values + _headroom + x0;
::memset(_values, 0, dst_width*height); ::memset(dst_ptr, 0, dst_width*height);
float sub_x = 0, sub_y = 0; float sub_x = 0, sub_y = 0;
stbtt_MakeCodepointBitmapSubpixelPrefilter(&font, stbtt_MakeCodepointBitmapSubpixelPrefilter(&font, dst_ptr,
(unsigned char *)_values + x0,
dst_width, dy + 1, dst_width, dst_width, dy + 1, dst_width,
scale*4, scale, scale*4, scale,
shift_x, shift_y, shift_x, shift_y,
@ -194,7 +199,7 @@ Ttf_font::Glyph_buffer::render_shifted(Codepoint const c,
.height = height, .height = height,
.vpos = (unsigned)((int)baseline + y0), .vpos = (unsigned)((int)baseline + y0),
.advance = scale*advance, .advance = scale*advance,
.values = _values }; .values = _values + _headroom };
} }