Always NUL-terminate TrueType font table buffer.

QuLogic · QuLogic · commit 0067441c473f · 2017-09-27T00:24:57.000-04:00
This fixes some possible heap buffer overflows, such as the following triggered by our cmmi10.ttf: ``` ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000235709 at pc 0x7f95efd3c48a bp 0x7ffe41b6ecc0 sp 0x7ffe41b6ecb0 READ of size 1 at 0x617000235709 thread T0 #0 0x7f95efd3c489 in utf16be_to_ascii extern/ttconv/pprdrv_tt.cpp:178 #1 0x7f95efd3c489 in Read_name(TTFONT*) extern/ttconv/pprdrv_tt.cpp:339 #2 0x7f95efd499ef in read_font(...) extern/ttconv/pprdrv_tt.cpp:1325 #3 0x7f95efd4c602 in get_pdf_charprocs(...) extern/ttconv/pprdrv_tt.cpp:1420 #4 0x7f95efd35c22 in py_get_pdf_charprocs src/_ttconv.cpp:217 0x617000235709 is located 1 bytes to the right of 648-byte region [0x617000235480,0x617000235708) allocated by thread T0 here: #0 0x7f9612262a38 in __interceptor_calloc (/usr/lib64/libasan.so.4+0xdea38) #1 0x7f95efd3b261 in GetTable(TTFONT*, char const*) extern/ttconv/pprdrv_tt.cpp:140 ```
diff --git a/extern/ttconv/pprdrv_tt.cpp b/extern/ttconv/pprdrv_tt.cpp
@@ -137,7 +137,7 @@ BYTE *GetTable(struct TTFONT *font, const char *name)
 
             offset = getULONG( ptr + 8 );
             length = getULONG( ptr + 12 );
-            table = (BYTE*)calloc( sizeof(BYTE), length );
+            table = (BYTE*)calloc( sizeof(BYTE), length + 2 );
 
             try
             {
@@ -160,6 +160,9 @@ BYTE *GetTable(struct TTFONT *font, const char *name)
                 free(table);
                 throw;
             }
+            /* Always NUL-terminate; add two in case of UTF16 strings. */
+            table[length] = '\0';
+            table[length + 1] = '\0';
             return table;
         }
 

Original file line number	Diff line number	Diff line change
`@@ -137,7 +137,7 @@ BYTE GetTable(struct TTFONT font, const char *name)`
`137`	`137`
`138`	`138`	`offset = getULONG( ptr + 8 );`
`139`	`139`	`length = getULONG( ptr + 12 );`
`140`		`- table = (BYTE*)calloc( sizeof(BYTE), length );`
	`140`	`+ table = (BYTE*)calloc( sizeof(BYTE), length + 2 );`
`141`	`141`
`142`	`142`	`try`
`143`	`143`	`{`
`@@ -160,6 +160,9 @@ BYTE GetTable(struct TTFONT font, const char *name)`
`160`	`160`	`free(table);`
`161`	`161`	`throw;`
`162`	`162`	`}`
	`163`	`+ /* Always NUL-terminate; add two in case of UTF16 strings. */`
	`164`	`+ table[length] = '\0';`
	`165`	`+ table[length + 1] = '\0';`
`163`	`166`	`return table;`
`164`	`167`	`}`
`165`	`168`