From 3245d354865def9d712bdffe61fa211ad6aa4081 Mon Sep 17 00:00:00 2001 From: Jeremy Tan Date: Sun, 30 Jul 2017 09:17:40 +0800 Subject: [PATCH 1/6] Fix out of bounds read in getsid Closes #3088 --- fontforge/parsettf.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/fontforge/parsettf.c +++ b/fontforge/parsettf.c @@ -3310,8 +3310,14 @@ } static const char *getsid(int sid,char **strings,int scnt,struct ttfinfo *info) { - if ( sid==-1 ) + if ( sid==-1 ) // Default value, indicating it's not present return( NULL ); + else if (sid < 0) { + LogError(_("Bad sid %d (0 <= sid < %d)\n"), sid, scnt+nStdStrings); + if (info != NULL) + info->bad_cff = true; + return NULL; + } else if ( sidscnt ) { @@ -6019,17 +6025,17 @@ for ( english=sf->names; english!=NULL && english->lang!=0x409; english=english->next ); if ( english==NULL ) return; - if ( english->names[ttf_family]!=NULL && + if ( english->names[ttf_family]!=NULL && sf->familyname!=NULL && strcmp(english->names[ttf_family],sf->familyname)==0 ) { free(english->names[ttf_family]); english->names[ttf_family]=NULL; } - if ( english->names[ttf_copyright]!=NULL && + if ( english->names[ttf_copyright]!=NULL && sf->copyright!=NULL && strcmp(english->names[ttf_copyright],sf->copyright)==0 ) { free(english->names[ttf_copyright]); english->names[ttf_copyright]=NULL; } - if ( english->names[ttf_fullname]!=NULL && + if ( english->names[ttf_fullname]!=NULL && sf->fullname!=NULL && strcmp(english->names[ttf_fullname],sf->fullname)==0 ) { free(english->names[ttf_fullname]); english->names[ttf_fullname]=NULL;