From e6579e6b128b4178f319d3a41acf0553a47a037f Mon Sep 17 00:00:00 2001 From: Rod Sheeter Date: Wed, 23 Aug 2017 12:59:55 -0700 Subject: [PATCH] Reject fonts with bad loca origLength or hmtx reserved bits set. Correct misplaced bracket in type conversion. --- src/woff2_dec.cc | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/src/woff2_dec.cc b/src/woff2_dec.cc index 0986cfd..b7c70df 100644 --- a/src/woff2_dec.cc +++ b/src/woff2_dec.cc @@ -411,6 +411,14 @@ bool ReconstructGlyf(const uint8_t* data, Table* glyf_table, return FONT_COMPRESSION_FAILURE(); } + // https://dev.w3.org/webfonts/WOFF2/spec/#conform-mustRejectLoca + // dst_length here is origLength in the spec + uint32_t expected_loca_dst_length = (info->index_format ? 4 : 2) + * (static_cast(info->num_glyphs) + 1); + if (PREDICT_FALSE(loca_table->dst_length != expected_loca_dst_length)) { + return FONT_COMPRESSION_FAILURE(); + } + unsigned int offset = (2 + kNumSubStreams) * 4; if (PREDICT_FALSE(offset > glyf_table->transform_length)) { return FONT_COMPRESSION_FAILURE(); @@ -669,6 +677,14 @@ bool ReconstructTransformedHmtx(const uint8_t* transformed_buf, bool has_proportional_lsbs = (hmtx_flags & 1) == 0; bool has_monospace_lsbs = (hmtx_flags & 2) == 0; + // Bits 2-7 are reserved and MUST be zero. + if ((hmtx_flags & 0xFC) != 0) { +#ifdef FONT_COMPRESSION_BIN + fprintf(stderr, "Illegal hmtx flags; bits 2-7 must be 0\n"); +#endif + return FONT_COMPRESSION_FAILURE(); + } + // you say you transformed but there is little evidence of it if (has_proportional_lsbs && has_monospace_lsbs) { return FONT_COMPRESSION_FAILURE(); @@ -914,7 +930,7 @@ bool ReconstructFont(uint8_t* transformed_buf, // TODO(user) a collection with optimized hmtx that reused glyf/loca // would fail. We don't optimize hmtx for collections yet. - if (PREDICT_FALSE(static_cast(table.src_offset + table.src_length) + if (PREDICT_FALSE(static_cast(table.src_offset) + table.src_length > transformed_buf_size)) { return FONT_COMPRESSION_FAILURE(); }