summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Set close-on-exec when opening fonts.dir & fonts.alias filesHEADmasterAlan Coopersmith2023-03-251-2/+6
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Remove "All rights reserved" from Oracle copyright noticesAlan Coopersmith2023-02-252-2/+2
| | | | | | Oracle no longer includes this term in our copyright & license notices. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* atom: Update Hash() to be unsignedJeremy Huddleston Sequoia2022-11-261-18/+16
| | | | | | This avoids undefined behavior (left shift overflow in signed integer type) Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Fix font server reconnection timeoutPeter Harris2022-11-101-0/+2
| | | | | | | | | | | | | | | The great libxfont2 rewrite 135fb032e940ce226c9feb13e6e903f3ecbc5eb0 split fs_wakeup into fs_wakeup and fs_fd_handler. The fs_fd_handler side is called when there is new data on the socket. The fs_wakeup side is called on a timeout. If there's a connection timeout, the block handler will set the timeout to zero, expecting fs_wakeup to handle the timeout. Therefore, we need to call _fs_check_reconnect in fs_wakeup to handle the connection timeout. If we don't, the X server will go to 100% CPU (and the font server connection will not be retried). Signed-off-by: Peter Harris <pharris@opentext.com>
* Switch from libbsd to libbsd-overlayGuillem Jover2022-10-061-6/+0
| | | | | | | | This is the preferred usage form for libbsd, as it makes the code more portable and requires no special includes for libbsd, by transparently injects the needed standard headers that would be used on a BSD. Signed-off-by: Guillem Jover <guillem@hadrons.org>
* Fix buffer overrun in FontFileMakeDir on WIN32Peter Harris2022-08-111-4/+5
| | | | | | | | | | | When dirName is "" (eg. when called by BuiltinReadDirectory), FontFileMakeDir would read after the string when WIN32 is defined. Fix the overrun issue by checking the location of the found : before adding two. Signed-off-by: Peter Harris <pharris@opentext.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Fix comments to reflect removal of OS/2 supportAlan Coopersmith2022-06-213-4/+4
| | | | | | | Commit 6c29007756301 removed OS/2 support from the code, but missed updating the comments to match. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Correct fsCreateACReq lengthJeremy Huddleston Sequoia2022-06-211-1/+1
| | | | | | Regressed-in: 6972ea08ee5b2ef1cfbdc2fcaf14f06bbd391561 Fixes: https://gitlab.freedesktop.org/xorg/lib/libxfont/-/issues/13 Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Fix spelling/wording issuesAlan Coopersmith2022-04-069-13/+13
| | | | | | | Found by using: codespell --builtin clear,rare,usage,informal,code,names Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Fix out-of-bounds read in FontFileMakeDir()Alex Richardson2021-07-141-4/+1
| | | | | | | BuiltinReadDirectory() calls FontFileMakeDir ("", builtin_dir_count); and this causes the `dirName[dirlen - 1]` access to read before the start of the string. I found this while porting Xvnc to CHERI-RISC-V (which has bounds and permissions on all pointers).
* Fix use after free when font server connection lostPeter Harris2021-03-021-21/+19
| | | | | | | | | | | | | | If there are multiple blocks waiting for the same font, only one of them will have ->freeFont set. The rest will be in a state of FS_DEPENDING. If the font server dies before the font finishes opening, the block with ->freeFont set will call ->unload_font, invalidating the pfont pointers in the remaining FS_DEPENDING blocks. Avoid a use after free (and potential crash) by passing conn to fs_cleanup_font instead of dereferencing pfont to find the conn. Signed-off-by: Peter Harris <pharris@opentext.com>
* Fix crash when font server connection lostPeter Harris2020-03-061-10/+10
| | | | | | | | | | | Always initialize the return value of fs_new_block_rec. Even if the conn->blockState is FS_BROKEN_CONNECTION | FS_RECONNECTING, we must not return with an uninitialized blockrec on the block list. When the blockrec times out, _fs_clean_aborted_blockrec calls fs_cleanup_bfont, which will try to follow pointers in the blockrec (which has not been initialized). Signed-off-by: Peter Harris <pharris@opentext.com>
* Fix Win32 build since c4ed2e06 "Add some unit testing utilities"Jon Turney2019-10-252-0/+45
| | | | Provide Win32 replacements for realpath() and err.h
* fs_read_glyphs: check if rep is null before dereferencingAlan Coopersmith2019-08-171-1/+2
| | | | | | | Resolves coverity warning def16 from the list in https://gitlab.freedesktop.org/xorg/lib/libxfont/issues/6 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* CatalogueRescan: if opendir() fails, unref fpes, but don't free the catAlan Coopersmith2019-08-171-4/+2
| | | | | | | | | | | None of the callers of CatalogueRescan check for failure before accessing the cat pointer so don't free it (especially without clearing the pointer to it in fpe->private), just unref the contents. Can only be triggered if somehow stat() succeeds on the directory, but opendir fails anyway (removed between the calls? permission problem?). Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* ComputeScaledProperties: check for valid pointers before making atomsAlan Coopersmith2019-08-171-2/+4
| | | | | | | Resolves coverity warning def23 from the list in https://gitlab.freedesktop.org/xorg/lib/libxfont/issues/6 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* stubs/atom.c: check for ResizeHashTable failureAlan Coopersmith2019-08-171-1/+3
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Fix whitespaceMaya Rashish2019-08-171-1/+1
|
* fontxlfd.c: tell gcc that switch fallthrough is intentionalAlan Coopersmith2019-08-041-0/+1
| | | | | | | | | | | | | Quiets: src/util/fontxlfd.c: In function ‘FontParseXLFDName’: src/util/fontxlfd.c:450:14: warning: this statement may fall through [-Wimplicit-fallthrough=] replaceChar = '*'; ~~~~~~~~~~~~^~~~~ src/util/fontxlfd.c:451:5: note: here case FONT_XLFD_REPLACE_ZERO: ^~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Convert multiplying malloc calls to use mallocarray insteadAlan Coopersmith2019-08-0414-28/+39
| | | | | | | Introduces mallocarray as a macro calling reallocarray with a NULL pointer for the old allocation. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Convert multiplying realloc calls to use reallocarray insteadAlan Coopersmith2019-08-0310-12/+21
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Add reallocarray fallback if not provided by libc nor libbsdAlan Coopersmith2019-08-032-0/+53
| | | | | | Implementation copied from the Xserver Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Use bounds checking string functions everywhereAlan Coopersmith2019-08-038-102/+131
| | | | | | | | Replace strcpy, strcat, sprintf with strlcpy, strlcat, snprintf everywhere, even where there were already bounds checks in place, to reduce time spent checking static analysis results. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Add strlcat & strlcpy fallbacks if not provided by libc nor libbsdAlan Coopersmith2019-08-033-0/+158
| | | | | | Implementations copied from the Xserver Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* avoid -Wformat errors from clang when building with -DDEBUGRin Okuyama2018-03-241-16/+16
| | | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=99882 Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Open files with O_NOFOLLOW. (CVE-2017-16611)Michal Srb2017-11-252-4/+26
| | | | | | | | | A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog. Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
* pcfGetProperties: Check string boundaries (CVE-2017-13722)Michal Srb2017-10-041-2/+11
| | | | | | | | Without the checks a malformed PCF file can cause the library to make atom from random heap memory that was behind the `strings` buffer. This may crash the process or leak information. Signed-off-by: Julien Cristau <jcristau@debian.org>
* Check for end of string in PatternMatch (CVE-2017-13720)Michal Srb2017-10-041-1/+3
| | | | | | | | If a pattern contains '?' character, any character in the string is skipped, even if it is '\0'. The rest of the matching then reads invalid memory. Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Julien Cristau <jcristau@debian.org>
* freetype: Fix a logic error in computing face nameAdam Jackson2016-06-101-1/+0
| | | | | | | | | gcc6 chirps an indentation warning here, but really this is bad code. Effectively this would ignore en_US or en_UK names for the font, despite that those are the English names the font is most likely to have. Signed-off-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* fserve: Fix a buffer read overrun in _fs_client_accessJeremy Huddleston Sequoia2016-05-301-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugs.freedesktop.org/show_bug.cgi?id=83224 Found by clang's Address Sanitizer crac.num_auths = set_font_authorizations(&authorizations, &authlen, client); /* Work around bug in xfs versions up through modular release 1.0.8 which rejects CreateAC packets with num_auths = 0 & authlen < 4 */ if (crac.num_auths == 0) { authorizations = padding; authlen = 4; } else { authlen = (authlen + 3) & ~0x3; } crac.length = (sizeof (fsCreateACReq) + authlen) >> 2; crac.acid = cur->acid; _fs_add_req_log(conn, FS_CreateAC); _fs_write(conn, (char *) &crac, sizeof (fsCreateACReq)); _fs_write(conn, authorizations, authlen); In the case in the report, set_font_authorizations setup authorizations as a 34 byte buffer (and authlen set to 34 as one would expect). The following block changed authlen to 36 to make it 4byte aligned and the final _fs_write() caused us to read 36 bytes from this 34 byte buffer. This changes the incorrect size increase to instead use _fs_write_pad which takes care of the padding for us. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* fstrans: Remove unused foo() functionJeremy Huddleston Sequoia2016-05-301-2/+0
| | | | | | | | | | | | | | The point of it seems to have been to silence an unused function warning, but there's no point if we're just transitioning that to another unused function warning. src/fc/fstrans.c:32:20: warning: unused function 'foo' [-Wunused-function] static inline void foo(void) { (void) is_numeric("a"); } ^ 1 warning generated. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> Reviewed-by: Keith Packard <keithp@keithp.com>
* fserve: Silence a -Wformat warningJeremy Huddleston Sequoia2016-05-291-2/+2
| | | | | | | | | src/fc/fserve.c:653:32: warning: format specifies type 'int' but the argument has type 'CARD32' (aka 'unsigned long') [-Wformat] " from font server\n", rep->length); ^~~~~~~~~~~ 1 warning generated. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* bitmap: Bail out on invalid input to FontFileMakeDir instead of calling ↵Jeremy Huddleston Sequoia2016-05-291-0/+4
| | | | | | | | | calloc for 0 bytes Found by clang static analysis: Call to 'calloc' has an allocation size of 0 bytes Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* FreeType: Correct an allocation sizeJeremy Huddleston Sequoia2016-05-291-1/+1
| | | | | | | | | | | Found by clang static analysis: Result of 'calloc' is converted to a pointer of type 'int', which is incompatible with sizeof operand type 'int *' This is likely benign because the old size was larger on any platform where sizeof(int) <= sizeof(void *), which is everywhere. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Convert to non-recursive build.Matt Turner2015-12-099-202/+0
|
* Eliminate calls back to X server or font server functions by name (v4)libXfont2-2.0.0Keith Packard2015-12-0874-894/+672
| | | | | | | | | | | | | | | | | | | | | | | | | | | This eliminates the weak symbol adventures and makes all of the calls back to the X server or Font server go through a table of functions instead, clarifying the required API. As this is a rather major change to the API for the library, it now installs itself as libXfont2 instead of libXfont, and the package config file is now xfont2.pc. All of the installed headers remain the same as the original library; there's now a new include file, libxfont2.h, which defines the X server and Font server interfaces. This moves util/atom.c to stubs/atom.c and reformats that file, hence the diff being larger than it would otherwise be. v2: Rename to libXfont2 instead of libXfont_2 as suggested by Emil Velikov Fix whitespace in stubs/atom.c, which was moved from util/ v3: Remove select masks from API. Expose single 'font_init' function for all library initialization. v4: Change name of distributed tarballs to libXfont2 as well Signed-off-by: Keith Packard <keithp@keithp.com>
* Add compiler warning flags and fix warningsKeith Packard2015-12-084-9/+10
| | | | | | Mostly signed vs unsigned comparisons Signed-off-by: Keith Packard <keithp@keithp.com>
* Use NO_WEAK_SYMBOLS instead of -flat_namespaceJeremy Huddleston Sequoia2015-10-211-10/+1
| | | | | | Lesser of two evil hacks, I suppose... This reverts commit 0386fa77367a305deea3cc27f8a3865cc3c467c0.
* stubs: Add missing externs for declarations in the NO_WEAK_SYMBOLS && PIC ↵Jeremy Huddleston Sequoia2015-10-211-23/+23
| | | | | | stubs resolution Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Fix is*() usage.Thomas Klausner2015-10-204-11/+11
| | | | | | | | | The argument must be an unsigned char or -1; in these cases we know it's not -1 so cast it to unsigned char. Fixes warning: array subscript is of type 'char' [-Wchar-subscripts] Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
* bdfReadCharacters: Allow negative DWIDTH valuesBenjamin Tissoires2015-07-281-1/+1
| | | | | | | | | | | | | | The fix for CVE-2015-1804 prevent DWIDTH to be negative. However, the spec states that "DWIDTH [...] is a vector indicating the position of the next glyph’s origin relative to the origin of this glyph." So negative values are correct. Found by trying to compile XTS. Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* bdfReadCharacters: ensure metrics fit into xCharInfo struct [CVE-2015-1804]Alan Coopersmith2015-03-171-2/+24
| | | | | | | | | | | | | | | We use 32-bit ints to read from the bdf file, but then try to stick into a 16-bit int in the xCharInfo struct, so make sure they won't overflow that range. Found by afl-1.24b. v2: Verify that additions won't overflow 32-bit int range either. v3: As Julien correctly observes, the previous check for bh & bw not being < 0 reduces the number of cases we need to check for overflow. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Julien Cristau <jcristau@debian.org>
* bdfReadCharacters: bailout if a char's bitmap cannot be read [CVE-2015-1803]Alan Coopersmith2015-03-171-1/+4
| | | | | | | | | | Previously would charge on ahead with a NULL pointer in ci->bits, and then crash later in FontCharInkMetrics() trying to access the bits. Found with afl-1.23b. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Julien Cristau <jcristau@debian.org>
* bdfReadProperties: property count needs range check [CVE-2015-1802]Alan Coopersmith2015-03-171-1/+3
| | | | | | | | | Avoid integer overflow or underflow when allocating memory arrays by multiplying the number of properties reported for a BDF font. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Julien Cristau <jcristau@debian.org>
* Set close-on-exec for font file I/O.Christos Zoulas2015-02-262-6/+11
| | | | | Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
* Use 'imdent' to realign cpp indentation levels in fslibos.hAlan Coopersmith2014-11-051-109/+109
| | | | | | | Parts were indented, others weren't, now is more consistent. 'git diff -w' shows no non-whitespace changes in this commit Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Remove unneeded checks for #ifndef X_NOT_POSIXAlan Coopersmith2014-11-051-2/+0
| | | | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Make shared library work on Cygwin/MinGWYaakov Selkowitz2014-06-2725-28/+182
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Weak symbols on PE platforms do not work the same way as on ELF platforms, hence we have been unable to have a fully functional shared libXfont until now. This patch works around these issues so that we can fix that. In summary, only when compiling shared libraries on NO_WEAK_SYMBOLS platforms, when the first stub is called, the invoking program is first checked to determine if it exports the stubbed functions. Then, for every stub call, if the function is exported by the loader, it is called instead of the stub code. serverClient and serverGeneration are data pointers, and therefore are replaced by getter functions. ErrorF is variadic, so the override is routed through VErrorF instead. FatalError has no va_list equivalent, but it is not actually used in libXfont and therefore should be safe to remove. This requires all X servers to export their symbols, which requires forthcoming patches for hw/xwin and xfs; the other xservers (including tigervnc) already do this via LD_EXPORT_SYMBOLS_FLAG. Signed-off-by: Yaakov Selkowitz <yselkowitz@users.sourceforge.net> Reviewed-by: Colin Harrison <colin.harrison@virgin.net> Acked-by: Alan Coopersmith <alan.coopersmith@oracle.com> Tested-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
* Use default glyphs when getting 16-bit font with 8-bit textKeith Packard2014-05-231-1/+5
| | | | | | | | | | When accessing a 16-bit font with firstRow > 0 with 8-bit text, check to see if the font has a default character and return that for every incoming character. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Don't build unused code in bitmapfunc.c if all bitmap formats are disabledAlan Coopersmith2014-05-231-0/+15
| | | | | | | | | | | | | | | | If the only bitmaps we support are builtins, don't need the code to register all the bitmap font file handlers. Fixes gcc warnings: bitmapfunc.c:110:1: warning: 'BitmapOpenBitmap' defined but not used [-Wunused-function] BitmapOpenBitmap (FontPathElementPtr fpe, FontPtr *ppFont, int flags, ^ bitmapfunc.c:155:1: warning: 'BitmapGetInfoBitmap' defined but not used [-Wunused-function] BitmapGetInfoBitmap (FontPathElementPtr fpe, FontInfoPtr pFontInfo, ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Rémi Cardona <remi@gentoo.org>
View Lorry Controller Status