configure.ac | 5 ---- doc/fontlib.xml | 5 +++- src/FreeType/ftfuncs.c | 20 ++++++++--------- src/FreeType/xttcap.c | 2 - src/bitmap/bdfread.c | 6 ++--- src/bitmap/bdfutils.c | 4 +-- src/bitmap/bitscale.c | 4 +++ src/bitmap/pcfread.c | 1 src/fc/fserve.c | 8 ++---- src/stubs/stubs.h | 57 ++++++++++++++++++++----------------------------- src/util/fontxlfd.c | 10 ++++---- 11 files changed, 57 insertions(+), 65 deletions(-)
New commits: commit 8cce9834b2e74dccad94ca0adf79ae5585e37d48 Author: Adam Jackson <a...@redhat.com> Date: Wed Aug 31 16:19:11 2016 -0400 libXfont 1.5.2 Signed-off-by: Adam Jackson <a...@redhat.com> diff --git a/configure.ac b/configure.ac index 640cc92..3325aa3 100644 --- a/configure.ac +++ b/configure.ac @@ -21,7 +21,7 @@ # Initialize Autoconf AC_PREREQ([2.60]) -AC_INIT([libXfont], [1.5.1], +AC_INIT([libXfont], [1.5.2], [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXfont]) AC_CONFIG_SRCDIR([Makefile.am]) AC_CONFIG_HEADERS([config.h include/X11/fonts/fontconf.h]) commit 42d85d1293b2753f3f200de0e960bacef0c973c7 Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Mon May 30 00:46:21 2016 -0700 fserve: Fix a buffer read overrun in _fs_client_access https://bugs.freedesktop.org/show_bug.cgi?id=83224 Found by clang's Address Sanitizer crac.num_auths = set_font_authorizations(&authorizations, &authlen, client); /* Work around bug in xfs versions up through modular release 1.0.8 which rejects CreateAC packets with num_auths = 0 & authlen < 4 */ if (crac.num_auths == 0) { authorizations = padding; authlen = 4; } else { authlen = (authlen + 3) & ~0x3; } crac.length = (sizeof (fsCreateACReq) + authlen) >> 2; crac.acid = cur->acid; _fs_add_req_log(conn, FS_CreateAC); _fs_write(conn, (char *) &crac, sizeof (fsCreateACReq)); _fs_write(conn, authorizations, authlen); In the case in the report, set_font_authorizations setup authorizations as a 34 byte buffer (and authlen set to 34 as one would expect). The following block changed authlen to 36 to make it 4byte aligned and the final _fs_write() caused us to read 36 bytes from this 34 byte buffer. This changes the incorrect size increase to instead use _fs_write_pad which takes care of the padding for us. Signed-off-by: Jeremy Huddleston Sequoia <jerem...@apple.com> (cherry picked from commit 6972ea08ee5b2ef1cfbdc2fcaf14f06bbd391561) diff --git a/src/fc/fserve.c b/src/fc/fserve.c index bbaa8bf..4fb5551 100644 --- a/src/fc/fserve.c +++ b/src/fc/fserve.c @@ -2850,14 +2850,12 @@ _fs_client_access (FSFpePtr conn, pointer client, Bool sync) if (crac.num_auths == 0) { authorizations = padding; authlen = 4; - } else { - authlen = (authlen + 3) & ~0x3; } crac.length = (sizeof (fsCreateACReq) + authlen) >> 2; crac.acid = cur->acid; _fs_add_req_log(conn, FS_CreateAC); _fs_write(conn, (char *) &crac, sizeof (fsCreateACReq)); - _fs_write(conn, authorizations, authlen); + _fs_write_pad(conn, authorizations, authlen); /* ignore reply; we don't even care about it */ conn->curacid = 0; cur->auth_generation = client_auth_generation(client); commit 2b09a7af9f19db886567e524f978ad393593f7c0 Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Sun May 29 23:37:13 2016 -0700 fserve: Silence a -Wformat warning src/fc/fserve.c:653:32: warning: format specifies type 'int' but the argument has type 'CARD32' (aka 'unsigned long') [-Wformat] " from font server\n", rep->length); ^~~~~~~~~~~ 1 warning generated. Signed-off-by: Jeremy Huddleston Sequoia <jerem...@apple.com> (cherry picked from commit e6009adbc89ec3e1f924bcb57b333c1c02f5e66d) diff --git a/src/fc/fserve.c b/src/fc/fserve.c index 92b0d53..bbaa8bf 100644 --- a/src/fc/fserve.c +++ b/src/fc/fserve.c @@ -631,8 +631,8 @@ fs_get_reply (FSFpePtr conn, int *error) */ if (rep->length > MAX_REPLY_LENGTH) { - ErrorF("fserve: reply length %d > MAX_REPLY_LENGTH, disconnecting" - " from font server\n", rep->length); + ErrorF("fserve: reply length %ld > MAX_REPLY_LENGTH, disconnecting" + " from font server\n", (long)rep->length); _fs_connection_died (conn); *error = FSIO_ERROR; return 0; commit 3eddbca2690381bbbaf14adadb2679eea702095f Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Sun May 29 23:34:35 2016 -0700 bitmap: Bail out on invalid input to FontFileMakeDir instead of calling calloc for 0 bytes Found by clang static analysis: Call to 'calloc' has an allocation size of 0 bytes Signed-off-by: Jeremy Huddleston Sequoia <jerem...@apple.com> (cherry picked from commit ac559fad20bbae45332c758abb6a790c3fd341a2) diff --git a/src/bitmap/bitscale.c b/src/bitmap/bitscale.c index c9af4c0..13ed924 100644 --- a/src/bitmap/bitscale.c +++ b/src/bitmap/bitscale.c @@ -1479,6 +1479,10 @@ BitmapScaleBitmaps(FontPtr pf, /* scaled font */ lastRow = pfi->lastRow; nchars = (lastRow - firstRow + 1) * (lastCol - firstCol + 1); + if (nchars <= 0) { + goto bail; + } + glyph = pf->glyph; for (i = 0; i < nchars; i++) { commit dfa572ea522a3019e91f2de7854b252c629342f2 Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Sun May 29 23:29:50 2016 -0700 FreeType: Correct an allocation size Found by clang static analysis: Result of 'calloc' is converted to a pointer of type 'int', which is incompatible with sizeof operand type 'int *' This is likely benign because the old size was larger on any platform where sizeof(int) <= sizeof(void *), which is everywhere. Signed-off-by: Jeremy Huddleston Sequoia <jerem...@apple.com> (cherry picked from commit d0fff111992fed9d9bfbf0c19e136bda9ba1db55) diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c index df64f5e..703353d 100644 --- a/src/FreeType/ftfuncs.c +++ b/src/FreeType/ftfuncs.c @@ -622,7 +622,7 @@ FreeTypeInstanceFindGlyph(unsigned idx_in, int flags, FTInstancePtr instance, offset = idx - segment * FONTSEGMENTSIZE; if((*available)[segment] == NULL) { - (*available)[segment] = calloc(FONTSEGMENTSIZE, sizeof(int *)); + (*available)[segment] = calloc(FONTSEGMENTSIZE, sizeof(int)); if((*available)[segment] == NULL) return AllocError; } commit bee4a764ccef46101dca03c70d4ad1793a5a5d78 Author: Keith Packard <kei...@keithp.com> Date: Mon Dec 7 15:46:13 2015 -0800 Fix warnings Mostly signed vs unsigned comparisons Signed-off-by: Keith Packard <kei...@keithp.com> Squashed commit of three cherry-picks from master: (cherry picked from commit eb67d10ae82b364a4324e96ce53baaa4e5e75f97) (cherry picked from commit eefc0b0b908eb8533e704d7156ce983ad7891cc5) (cherry picked from commit d967caa988eaabd9e84c82879e2f21bd33b952a7) diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c index c440fde..df64f5e 100644 --- a/src/FreeType/ftfuncs.c +++ b/src/FreeType/ftfuncs.c @@ -474,7 +474,7 @@ FreeTypeOpenInstance(FTInstancePtr *instance_return, FTFacePtr face, if( FT_IS_SFNT( face->face ) ) { #if 1 FT_F26Dot6 tt_char_width, tt_char_height, tt_dim_x, tt_dim_y; - FT_UInt nn; + FT_Int nn; instance->strike_index=0xFFFFU; @@ -1454,7 +1454,7 @@ FreeTypeRasteriseGlyph(unsigned idx, int flags, CharInfoPtr tgp, } for( i = MAX(0, dy) ; i<ht ; i++ ){ int prev_jj,jj; - if( bitmap->rows <= i-dy ) break; + if( bitmap->rows <= (unsigned) (i-dy) ) break; current_buffer=(unsigned char *)(bitmap->buffer+bitmap->pitch*(i-dy)); current_raster=(unsigned char *)(raster+i*bpr); j = MAX(0,div_dx); @@ -2985,13 +2985,13 @@ ft_compute_bounds(FTFontPtr font, FontInfoPtr pinfo, FontScalablePtr vals ) c = row<<8|col; flags=0; if ( !force_c_outside ) { - if ( c <= instance->ttcap.forceConstantSpacingEnd - && instance->ttcap.forceConstantSpacingBegin <= c ) + if ( (signed) c <= instance->ttcap.forceConstantSpacingEnd + && instance->ttcap.forceConstantSpacingBegin <= (signed) c ) flags|=FT_FORCE_CONSTANT_SPACING; } else { /* for GB18030 proportional */ - if ( c <= instance->ttcap.forceConstantSpacingEnd - || instance->ttcap.forceConstantSpacingBegin <= c ) + if ( (signed) c <= instance->ttcap.forceConstantSpacingEnd + || instance->ttcap.forceConstantSpacingBegin <= (signed) c ) flags|=FT_FORCE_CONSTANT_SPACING; } #if 0 diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c index eccd7b7..f343eed 100644 --- a/src/bitmap/bdfread.c +++ b/src/bitmap/bdfread.c @@ -298,7 +298,7 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState, bdfError("invalid number of CHARS in BDF file\n"); return (FALSE); } - if (nchars > INT32_MAX / sizeof(CharInfoRec)) { + if (nchars > (signed) (INT32_MAX / sizeof(CharInfoRec))) { bdfError("Couldn't allocate pCI (%d*%d)\n", nchars, (int) sizeof(CharInfoRec)); goto BAILOUT; @@ -631,7 +631,7 @@ bdfReadProperties(FontFilePtr file, FontPtr pFont, bdfFileState *pState) } if ((sscanf((char *) line, "STARTPROPERTIES %d", &nProps) != 1) || (nProps <= 0) || - (nProps > ((INT32_MAX / sizeof(FontPropRec)) - BDF_GENPROPS))) { + (nProps > (signed) ((INT32_MAX / sizeof(FontPropRec)) - BDF_GENPROPS))) { bdfError("bad 'STARTPROPERTIES'\n"); return (FALSE); } diff --git a/src/bitmap/pcfread.c b/src/bitmap/pcfread.c index 34eeeb7..33871ae 100644 --- a/src/bitmap/pcfread.c +++ b/src/bitmap/pcfread.c @@ -487,7 +487,6 @@ pcfReadFont(FontPtr pFont, FontFilePtr file, for (i = 0; i < GLYPHPADOPTIONS; i++) { bitmapSizes[i] = pcfGetINT32(file, format); if (IS_EOF(file)) goto Bail; - if (bitmapSizes[i] < 0) goto Bail; } sizebitmaps = bitmapSizes[PCF_GLYPH_PAD_INDEX(format)]; commit d6877a7c1c35985f6a75b6cd4e814595e781adc4 Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Wed Oct 21 21:03:00 2015 -0700 Use NO_WEAK_SYMBOLS instead of -flat_namespace Lesser of two evil hacks, I suppose... This reverts commit 0386fa77367a305deea3cc27f8a3865cc3c467c0. diff --git a/configure.ac b/configure.ac index 7cb6bdf..640cc92 100644 --- a/configure.ac +++ b/configure.ac @@ -213,9 +213,6 @@ case $host_os in linux*) OS_CFLAGS="-D_XOPEN_SOURCE" ;; - darwin*) - OS_CFLAGS="-Wl,-flat_namespace" - ;; *) OS_CFLAGS= ;; diff --git a/src/stubs/stubs.h b/src/stubs/stubs.h index c09c675..9e71806 100644 --- a/src/stubs/stubs.h +++ b/src/stubs/stubs.h @@ -10,7 +10,7 @@ #endif /* this probably works for Mach-O too, but probably not for PE */ -#if (defined(__APPLE__) || defined(__ELF__)) && defined(__GNUC__) && (__GNUC__ >= 3) +#if defined(__ELF__) && defined(__GNUC__) && (__GNUC__ >= 3) #define weak __attribute__((weak)) #else #define weak @@ -67,15 +67,6 @@ extern void (*__register_fpe_functions)(void); #define OVERRIDE_VA_SYMBOL(sym,f) #endif -/* This is really just a hack for now... __APPLE__ really should be using - * the weak symbols route above, but it's causing an as-yet unresolved issue, - * so we're instead building with flat_namespace. - */ -#ifdef __APPLE__ -#undef weak -#define weak -#endif - extern FontPtr find_old_font ( FSID id ); extern int set_font_authorizations ( char **authorizations, int *authlen, commit 2788c6984bc54bfba61b2dbdb5353978199d8a37 Author: Jeremy Huddleston Sequoia <jerem...@apple.com> Date: Wed Oct 21 21:27:26 2015 -0700 stubs: Add missing externs for declarations in the NO_WEAK_SYMBOLS && PIC stubs resolution Signed-off-by: Jeremy Huddleston Sequoia <jerem...@apple.com> diff --git a/src/stubs/stubs.h b/src/stubs/stubs.h index 7d499d5..c09c675 100644 --- a/src/stubs/stubs.h +++ b/src/stubs/stubs.h @@ -38,29 +38,29 @@ extern int _font_init_stubs(void); (*__##sym)(f, _args); \ va_end(_args) -int (*__client_auth_generation)(ClientPtr); -Bool (*__ClientSignal)(ClientPtr); -void (*__DeleteFontClientID)(Font); -void (*__VErrorF)(const char *, va_list); -FontPtr (*__find_old_font)(FSID); -FontResolutionPtr (*__GetClientResolutions)(int *); -int (*__GetDefaultPointSize)(void); -Font (*__GetNewFontClientID)(void); -unsigned long (*__GetTimeInMillis)(void); -int (*__init_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr); -int (*__RegisterFPEFunctions)(NameCheckFunc, InitFpeFunc, FreeFpeFunc, - ResetFpeFunc, OpenFontFunc, CloseFontFunc, ListFontsFunc, - StartLfwiFunc, NextLfwiFunc, WakeupFpeFunc, ClientDiedFunc, - LoadGlyphsFunc, StartLaFunc, NextLaFunc, SetPathFunc); -void (*__remove_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr, Bool); -void **__ptr_serverClient; -int (*__set_font_authorizations)(char **, int *, ClientPtr); -int (*__StoreFontClientFont)(FontPtr, Font); -Atom (*__MakeAtom)(const char *, unsigned, int); -int (*__ValidAtom)(Atom); -char *(*__NameForAtom)(Atom); -unsigned long *__ptr_serverGeneration; -void (*__register_fpe_functions)(void); +extern int (*__client_auth_generation)(ClientPtr); +extern Bool (*__ClientSignal)(ClientPtr); +extern void (*__DeleteFontClientID)(Font); +extern void (*__VErrorF)(const char *, va_list); +extern FontPtr (*__find_old_font)(FSID); +extern FontResolutionPtr (*__GetClientResolutions)(int *); +extern int (*__GetDefaultPointSize)(void); +extern Font (*__GetNewFontClientID)(void); +extern unsigned long (*__GetTimeInMillis)(void); +extern int (*__init_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr); +extern int (*__RegisterFPEFunctions)(NameCheckFunc, InitFpeFunc, FreeFpeFunc, + ResetFpeFunc, OpenFontFunc, CloseFontFunc, ListFontsFunc, + StartLfwiFunc, NextLfwiFunc, WakeupFpeFunc, ClientDiedFunc, + LoadGlyphsFunc, StartLaFunc, NextLaFunc, SetPathFunc); +extern void (*__remove_fs_handlers)(FontPathElementPtr, BlockHandlerProcPtr, Bool); +extern void **__ptr_serverClient; +extern int (*__set_font_authorizations)(char **, int *, ClientPtr); +extern int (*__StoreFontClientFont)(FontPtr, Font); +extern Atom (*__MakeAtom)(const char *, unsigned, int); +extern int (*__ValidAtom)(Atom); +extern char *(*__NameForAtom)(Atom); +extern unsigned long *__ptr_serverGeneration; +extern void (*__register_fpe_functions)(void); #else /* NO_WEAK_SYMBOLS && PIC */ #define OVERRIDE_DATA(sym) #define OVERRIDE_SYMBOL(sym,...) commit d66f107d6e714a54515f39d94caf46aef9be7416 Author: Thomas Klausner <w...@netbsd.org> Date: Wed Feb 25 21:45:50 2015 +0100 Fix is*() usage. The argument must be an unsigned char or -1; in these cases we know it's not -1 so cast it to unsigned char. Fixes warning: array subscript is of type 'char' [-Wchar-subscripts] Signed-off-by: Thomas Klausner <w...@netbsd.org> diff --git a/src/FreeType/ftfuncs.c b/src/FreeType/ftfuncs.c index a4969d1..c440fde 100644 --- a/src/FreeType/ftfuncs.c +++ b/src/FreeType/ftfuncs.c @@ -2061,7 +2061,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol, long val; /* skip comma and/or space */ - while (',' == *p || isspace(*p)) + while (',' == *p || isspace((unsigned char)*p)) p++; /* begin point */ @@ -2079,7 +2079,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol, } /* skip space */ - while (isspace(*p)) + while (isspace((unsigned char)*p)) p++; if (',' != *p && '\0' != *p) { @@ -2092,7 +2092,7 @@ restrict_code_range_by_str(int count,unsigned short *refFirstCol, break; /* skip space */ - while (isspace(*p)) + while (isspace((unsigned char)*p)) p++; val = strtol(p, (char **)&q, 0); diff --git a/src/FreeType/xttcap.c b/src/FreeType/xttcap.c index cee752e..e30e0f9 100644 --- a/src/FreeType/xttcap.c +++ b/src/FreeType/xttcap.c @@ -632,7 +632,7 @@ SPropRecValList_add_by_font_cap(SDynPropRecValList *pThisList, } break; } - if ( !isdigit(*p) ) + if ( !isdigit((unsigned char)*p) ) break; } } diff --git a/src/bitmap/bdfutils.c b/src/bitmap/bdfutils.c index 288148b..438d197 100644 --- a/src/bitmap/bdfutils.c +++ b/src/bitmap/bdfutils.c @@ -207,11 +207,11 @@ bdfIsInteger(char *str) char c; c = *str++; - if (!(isdigit(c) || c == '-' || c == '+')) + if (!(isdigit((unsigned char)c) || c == '-' || c == '+')) return (FALSE); while ((c = *str++)) - if (!isdigit(c)) + if (!isdigit((unsigned char)c)) return (FALSE); return (TRUE); diff --git a/src/util/fontxlfd.c b/src/util/fontxlfd.c index 974128e..99a3679 100644 --- a/src/util/fontxlfd.c +++ b/src/util/fontxlfd.c @@ -145,9 +145,9 @@ xlfd_double_to_text(double value, char *buffer, int space_required) if (value == 0.0) exponent = 0; /* Figure out how many digits are significant */ - while (p1 >= buffer && (!isdigit(*p1) || *p1 == '0')) p1--; + while (p1 >= buffer && (!isdigit((unsigned char)*p1) || *p1 == '0')) p1--; ndigits = 0; - while (p1 >= buffer) if (isdigit(*p1--)) ndigits++; + while (p1 >= buffer) if (isdigit((unsigned char)*p1--)) ndigits++; /* Figure out notation to use */ if (exponent >= XLFD_NDIGITS || ndigits - exponent > XLFD_NDIGITS + 1) @@ -278,7 +278,7 @@ GetMatrix(char *ptr, FontScalablePtr vals, int which) matrix = vals->point_matrix; else return (char *)0; - while (isspace(*ptr)) ptr++; + while (isspace((unsigned char)*ptr)) ptr++; if (*ptr == '[') { /* This is a matrix containing real numbers. It would be nice @@ -292,13 +292,13 @@ GetMatrix(char *ptr, FontScalablePtr vals, int which) (ptr = readreal(ptr, matrix + 2)) && (ptr = readreal(ptr, matrix + 3))) { - while (isspace(*ptr)) ptr++; + while (isspace((unsigned char)*ptr)) ptr++; if (*ptr != ']') ptr = (char *)0; else { ptr++; - while (isspace(*ptr)) ptr++; + while (isspace((unsigned char)*ptr)) ptr++; if (*ptr == '-') { if (which == POINTSIZE_MASK) commit 1a73d6828dfa03924f2d68644fb5b99afd9c78e2 Author: Benjamin Tissoires <benjamin.tissoi...@gmail.com> Date: Mon Jul 13 14:43:06 2015 -0400 bdfReadCharacters: Allow negative DWIDTH values The fix for CVE-2015-1804 prevent DWIDTH to be negative. However, the spec states that "DWIDTH [...] is a vector indicating the position of the next glyph’s origin relative to the origin of this glyph." So negative values are correct. Found by trying to compile XTS. Signed-off-by: Benjamin Tissoires <benjamin.tissoi...@gmail.com> Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net> Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c index a0ace8f..eccd7b7 100644 --- a/src/bitmap/bdfread.c +++ b/src/bitmap/bdfread.c @@ -426,7 +426,7 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState, goto BAILOUT; } /* xCharInfo metrics are stored as INT16 */ - if ((wx < 0) || (wx > INT16_MAX)) { + if ((wx < INT16_MIN) || (wx > INT16_MAX)) { bdfError("character '%s' has out of range width, %d\n", charName, wx); goto BAILOUT; commit 159bfa4ec094e7d342c9b59c31bfea7dccbac58a Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Sat Feb 7 17:24:48 2015 -0800 doc: add a couple olinks to fsproto & xfs-design docs Don't seem to have ability to link to BDF or Xserver internals docs yet Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> diff --git a/doc/fontlib.xml b/doc/fontlib.xml index c5079c8..ce31bb5 100644 --- a/doc/fontlib.xml +++ b/doc/fontlib.xml @@ -111,8 +111,9 @@ </listitem> <listitem> <para> + <olink targetdoc='xfs-design' targetptr='xfs-design'> <citetitle pubwork="article">Font Server Implementation - Overview</citetitle> which discusses the design of the font + Overview</citetitle></olink> which discusses the design of the font server. </para> </listitem> @@ -126,7 +127,9 @@ </listitem> <listitem> <para> + <olink targetdoc='fsproto' targetptr='fsproto'> <citetitle pubwork="article">The X Font Service Protocol</citetitle> + </olink> for a description of the constraints placed on the design by including support for this font service mechanism. </para>