diff options
| author | Henry Stiles <henry.stiles@artifex.com> | 2014-02-24 10:41:23 -0700 |
|---|---|---|
| committer | Henry Stiles <henry.stiles@artifex.com> | 2014-02-24 10:54:03 -0700 |
| commit | 9990bdac31c018de33de2c09053b7e392a26304f (patch) | |
| tree | 5b536a6c1590c504328c90e15d707c45c6adeaf0 | |
| parent | b6f8dba649f1be2ba5b9eb1d257f2052f7f2df28 (diff) | |
| download | ghostpdl-9990bdac31c018de33de2c09053b7e392a26304f.tar.gz | |
Fix Bug 694685 - Seg faults found by fuzzing in sfopen.
PCL would continue processing with a corrupt font. This could lead to
bad memory accesses as demonstrated by the fuzzing example. For now,
we return an error when a corrupt font is encountered and end the job.
Likely, a lighter approach is called for: continue process without
defining the font. This would be a bit more involved and we'll
consider it if users report HP precedent for the behavior.
| -rw-r--r-- | pcl/pcsfont.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/pcl/pcsfont.c b/pcl/pcsfont.c index d5b22efd7..417323876 100644 --- a/pcl/pcsfont.c +++ b/pcl/pcsfont.c @@ -41,9 +41,7 @@ #include "gxfont.h" #include "gxfont42.h" -/* comment out to return an error instead of continuing when - processing a corrupt download font. */ -#define IGNORE_CORRUPT_FONT +#define IGNORE_BAD_HEADER_FORMAT_SPECIFIER /* Emulate bug in HP printer where component metrics are ignored. */ #define DISABLE_USE_MY_METRICS @@ -289,7 +287,7 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs) has_checksum = true; break; default: -#ifdef IGNORE_CORRUPT_FONT +#ifdef IGNORE_BAD_HEADER_FORMAT_SPECIFIER return 0; #else return_error(gs_error_invalidfont); @@ -313,7 +311,7 @@ pcl_font_header(pcl_args_t * pargs, pcl_state_t * pcs) if (sum != 0) { dmprintf1(pcs->memory, "corrupt font sum=%ld\n", sum); - return e_Range; + return_error(gs_error_invalidfont); } } /* Delete any previous font with this ID. */ |