xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

libdraw: check fontchar count in openmemsubfont() and readsubfont()

Browse source
This commit is contained in:
cinap_lenrek 2015-02-24 03:30:21 +01:00
parent 5f8cacd2de
commit 4235556c16
2 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
sys/src/libdraw/readsubfont.c
View file

@ -18,23 +18,22 @@ readsubfonti(Display*d, char *name, int fd, Image *ai, int dolock)
if(i == nil) if(i == nil)
return nil; return nil;
} }
p = nil;
if(read(fd, hdr, 3*12) != 3*12){ if(read(fd, hdr, 3*12) != 3*12){
if(ai == nil) werrstr("readsubfont: header read error: %r");
freeimage(i); goto Err;
werrstr("rdsubfonfile: header read error: %r");
return nil;
} }
n = atoi(hdr); n = atoi(hdr);
if(n <= 0 || n > 0x7fff){
werrstr("readsubfont: bad fontchar count %d", n);
goto Err;
}
p = malloc(6*(n+1)); p = malloc(6*(n+1));
if(p == nil) if(p == nil)
goto Err; goto Err;
if(read(fd, p, 6*(n+1)) != 6*(n+1)){ if(read(fd, p, 6*(n+1)) != 6*(n+1)){
werrstr("rdsubfonfile: fontchar read error: %r"); werrstr("readsubfont: fontchar read error: %r");
Err: goto Err;
if(ai == nil)
freeimage(i);
free(p);
return nil;
} }
fc = malloc(sizeof(Fontchar)*(n+1)); fc = malloc(sizeof(Fontchar)*(n+1));
if(fc == nil) if(fc == nil)
@ -51,6 +50,11 @@ readsubfonti(Display*d, char *name, int fd, Image *ai, int dolock)
} }
free(p); free(p);
return f; return f;
Err:
if(ai == nil)
freeimage(i);
free(p);
return nil;
} }
Subfont* Subfont*

10
sys/src/libmemdraw/openmemsubfont.c
View file

@ -25,6 +25,10 @@ openmemsubfont(char *name)
goto Err; goto Err;
} }
n = atoi(hdr); n = atoi(hdr);
if(n <= 0 || n > 0x7fff){
werrstr("openmemsubfont: bad fontchar count %d", n);
goto Err;
}
p = malloc(6*(n+1)); p = malloc(6*(n+1));
if(p == nil) if(p == nil)
goto Err; goto Err;
@ -46,9 +50,7 @@ openmemsubfont(char *name)
return sf; return sf;
Err: Err:
close(fd); close(fd);
if (i != nil) free(p);
freememimage(i); freememimage(i);
if (p != nil)
free(p);
return nil; return nil;
} }