src/fccache.c | 17 ++++++++++-------
src/fcxml.c | 7 ++++++-
test/test-bz106632.c | 29 +++++++++++++++--------------
test/test-hash.c | 5 ++---
4 files changed, 33 insertions(+), 25 deletions(-)
New commits:
commit 699d6e4d8415a5d94483ea81fdf277964a33b8f1
Author: Akira TAGOH <akira@xxxxxxxxx>
Date: Wed Jan 23 05:59:24 2019 +0000
Fix a crash with invalid matrix element
Fixes https://gitlab.freedesktop.org/fontconfig/fontconfig/issues/140
diff --git a/src/fcxml.c b/src/fcxml.c
index fb60df2..103b248 100644
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -1480,6 +1480,11 @@ FcParseMatrix (FcConfigParse *parse)
m.xy = FcPopExpr (parse);
m.xx = FcPopExpr (parse);
+ if (!m.yy || !m.yx || !m.xy || !m.xx)
+ {
+ FcConfigMessage (parse, FcSevereWarning, "Missing values in matrix element");
+ return;
+ }
if (FcPopExpr (parse))
FcConfigMessage (parse, FcSevereError, "wrong number of matrix elements");
else
commit b047e299546ac3abb79cf0bac3c67f5c2dfc7fb6
Author: Akira TAGOH <akira@xxxxxxxxx>
Date: Fri Nov 30 10:42:26 2018 +0000
Fix a dereference of a null pointer
When exiting from for loop by not satisfying the condition of `(s = next[i])` at FcCacheRemoveUnlocked()
referring s->alloated will be invalid.
diff --git a/src/fccache.c b/src/fccache.c
index 87073ba..3352a66 100644
--- a/src/fccache.c
+++ b/src/fccache.c
@@ -710,15 +710,18 @@ FcCacheRemoveUnlocked (FcCache *cache)
while (fcCacheMaxLevel > 0 && fcCacheChains[fcCacheMaxLevel - 1] == NULL)
fcCacheMaxLevel--;
- allocated = s->allocated;
- while (allocated)
+ if (s)
{
- /* First element in allocated chunk is the free list */
- next = *(void **)allocated;
- free (allocated);
- allocated = next;
+ allocated = s->allocated;
+ while (allocated)
+ {
+ /* First element in allocated chunk is the free list */
+ next = *(void **)allocated;
+ free (allocated);
+ allocated = next;
+ }
+ free (s);
}
- free (s);
}
static FcCache *
commit 3a45b8ef6511aee22b48c2a54f59faf6172a5071
Author: Akira TAGOH <akira@xxxxxxxxx>
Date: Fri Nov 30 07:27:39 2018 +0000
covscan: fix compiler warnings
diff --git a/test/test-bz106632.c b/test/test-bz106632.c
index 8558b58..15ec376 100644
--- a/test/test-bz106632.c
+++ b/test/test-bz106632.c
@@ -158,11 +158,11 @@ unlink_dirs (const char *dir)
int
main (void)
{
- FcChar8 *fontdir = NULL, *cachedir = NULL, *fontname;
+ FcChar8 *fontdir = NULL, *cachedir = NULL;
char *basedir, template[512] = "/tmp/bz106632-XXXXXX";
char cmd[512];
FcConfig *config;
- const FcChar8 *tconf = "<fontconfig>\n"
+ const FcChar8 *tconf = (const FcChar8 *) "<fontconfig>\n"
" <dir>%s</dir>\n"
" <cachedir>%s</cachedir>\n"
"</fontconfig>\n";
@@ -178,21 +178,21 @@ main (void)
fprintf (stderr, "%s: %s\n", template, strerror (errno));
goto bail;
}
- fontdir = FcStrBuildFilename (basedir, "fonts", NULL);
- cachedir = FcStrBuildFilename (basedir, "cache", NULL);
+ fontdir = FcStrBuildFilename ((const FcChar8 *) basedir, (const FcChar8 *) "fonts", NULL);
+ cachedir = FcStrBuildFilename ((const FcChar8 *) basedir, (const FcChar8 *) "cache", NULL);
fprintf (stderr, "D: Creating %s\n", fontdir);
- mkdir_p (fontdir);
+ mkdir_p ((const char *) fontdir);
fprintf (stderr, "D: Creating %s\n", cachedir);
- mkdir_p (cachedir);
+ mkdir_p ((const char *) cachedir);
fprintf (stderr, "D: Copying %s to %s\n", FONTFILE, fontdir);
snprintf (cmd, 512, "cp -a %s %s", FONTFILE, fontdir);
- system (cmd);
+ (void) system (cmd);
fprintf (stderr, "D: Loading a config\n");
- snprintf (conf, 1024, tconf, fontdir, cachedir);
+ snprintf (conf, 1024, (const char *) tconf, fontdir, cachedir);
config = FcConfigCreate ();
- if (!FcConfigParseAndLoadFromMemory (config, conf, FcTrue))
+ if (!FcConfigParseAndLoadFromMemory (config, (const FcChar8 *) conf, FcTrue))
{
printf ("E: Unable to load config\n");
ret = 1;
@@ -216,7 +216,7 @@ main (void)
}
fprintf (stderr, "D: Removing %s\n", fontdir);
snprintf (cmd, 512, "rm -f %s%s*; sleep 1", fontdir, FC_DIR_SEPARATOR_S);
- system (cmd);
+ (void) system (cmd);
fprintf (stderr, "D: Reinitializing\n");
if (!FcConfigUptoDate (config) || !FcInitReinitialize ())
{
@@ -231,7 +231,7 @@ main (void)
goto bail;
}
config = FcConfigCreate ();
- if (!FcConfigParseAndLoadFromMemory (config, conf, FcTrue))
+ if (!FcConfigParseAndLoadFromMemory (config, (const FcChar8 *) conf, FcTrue))
{
printf ("E: Unable to load config again\n");
ret = 4;
@@ -255,7 +255,7 @@ main (void)
}
fprintf (stderr, "D: Copying %s to %s\n", FONTFILE, fontdir);
snprintf (cmd, 512, "cp -a %s %s; sleep 1", FONTFILE, fontdir);
- system (cmd);
+ (void) system (cmd);
fprintf (stderr, "D: Reinitializing\n");
if (!FcConfigUptoDate (config) || !FcInitReinitialize ())
{
@@ -270,7 +270,7 @@ main (void)
goto bail;
}
config = FcConfigCreate ();
- if (!FcConfigParseAndLoadFromMemory (config, conf, FcTrue))
+ if (!FcConfigParseAndLoadFromMemory (config, (const FcChar8 *) conf, FcTrue))
{
printf ("E: Unable to load config again\n");
ret = 4;
diff --git a/test/test-hash.c b/test/test-hash.c
index 7530e82..7220273 100644
--- a/test/test-hash.c
+++ b/test/test-hash.c
@@ -45,7 +45,7 @@ fini (Test *test)
}
static FcBool
-test_add (Test *test, FcChar8 *key, FcBool replace)
+test_add (Test *test, char *key, FcBool replace)
{
uuid_t uuid;
void *u;
@@ -68,7 +68,7 @@ test_add (Test *test, FcChar8 *key, FcBool replace)
}
static FcBool
-test_remove (Test *test, FcChar8 *key)
+test_remove (Test *test, char *key)
{
void *u;
@@ -87,7 +87,6 @@ int
main (void)
{
Test *test;
- uuid_t uuid;
int ret = 0;
test = init ();
commit c44fda28e1dc0251f4451d1643f77e1455b80462
Author: Akira TAGOH <akira@xxxxxxxxx>
Date: Fri Nov 30 07:12:21 2018 +0000
Don't call unlink_dirs if basedir is null
diff --git a/test/test-bz106632.c b/test/test-bz106632.c
index c2edd72..8558b58 100644
--- a/test/test-bz106632.c
+++ b/test/test-bz106632.c
@@ -295,7 +295,8 @@ main (void)
bail:
fprintf (stderr, "Cleaning up\n");
- unlink_dirs (basedir);
+ if (basedir)
+ unlink_dirs (basedir);
if (fontdir)
FcStrFree (fontdir);
if (cachedir)
commit a57647e1556a67037176ff267a4ba4a2a4dfb59d
Author: Akira TAGOH <akira@xxxxxxxxx>
Date: Mon Nov 12 05:01:50 2018 +0000
covscan fix: get rid of unnecessary condition check
diff --git a/src/fcxml.c b/src/fcxml.c
index 81f0cbc..fb60df2 100644
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -3259,8 +3259,8 @@ FcConfigParseAndLoadDir (FcConfig *config,
/*
* Add all files of the form [0-9]*.conf
*/
+ d_len = strlen (e->d_name);
if ('0' <= e->d_name[0] && e->d_name[0] <= '9' &&
- (d_len = strlen (e->d_name)) < FC_MAX_FILE_LEN &&
d_len > TAIL_LEN &&
strcmp (e->d_name + d_len - TAIL_LEN, TAIL) == 0)
{
_______________________________________________
Fontconfig mailing list
Fontconfig@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/fontconfig
