diff options
Diffstat (limited to 'src/fontfile/dirfile.c')
| -rw-r--r-- | src/fontfile/dirfile.c | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/src/fontfile/dirfile.c b/src/fontfile/dirfile.c index bb7c339..b75042a 100644 --- a/src/fontfile/dirfile.c +++ b/src/fontfile/dirfile.c @@ -25,7 +25,7 @@ used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from The Open Group. */ -/* $XFree86: xc/lib/font/fontfile/dirfile.c,v 3.16 2003/04/07 16:23:31 eich Exp $ */ +/* $XFree86: xc/lib/font/fontfile/dirfile.c,v 3.18 2004/02/11 21:11:18 dawes Exp $ */ /* * Author: Keith Packard, MIT X Consortium @@ -68,6 +68,9 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr *pdir) FontDirectoryPtr dir = NullFontDirectory; + if (strlen(directory) + 1 + sizeof(FontDirFile) > sizeof(dir_file)) + return BadFontPath; + #ifdef FONTDIRATTRIB /* Check for font directory attributes */ #ifndef __UNIXOS2__ @@ -159,6 +162,9 @@ FontFileDirectoryChanged(FontDirectoryPtr dir) char dir_file[MAXFONTFILENAMELEN]; struct stat statb; + if (strlen(dir->directory) + sizeof(FontDirFile) > sizeof(dir_file)) + return FALSE; + strcpy (dir_file, dir->directory); strcat (dir_file, FontDirFile); if (stat (dir_file, &statb) == -1) @@ -207,6 +213,8 @@ AddFileNameAliases(FontDirectoryPtr dir) continue; len = strlen (fileName) - renderer->fileSuffixLen; + if (len >= sizeof(copy)) + continue; CopyISOLatin1Lowered (copy, fileName, len); copy[len] = '\0'; name.name = copy; @@ -256,9 +264,13 @@ ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir) int status = Successful; struct stat statb; + if (strlen(directory) >= sizeof(alias_file)) + return BadFontPath; dir = *pdir; strcpy(alias_file, directory); if (!isFile) { + if (strlen(directory) + 1 + sizeof(FontAliasFile) > sizeof(alias_file)) + return BadFontPath; if (directory[strlen(directory) - 1] != '/') strcat(alias_file, "/"); strcat(alias_file, FontAliasFile); @@ -291,6 +303,10 @@ ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir) status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(alias)) { + status = BadFontPath; + break; + } strcpy(alias, lexToken); token = lexAlias(file, &lexToken); switch (token) { @@ -307,6 +323,10 @@ ReadFontAlias(char *directory, Bool isFile, FontDirectoryPtr *pdir) status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(font_name)) { + status = BadFontPath; + break; + } CopyISOLatin1Lowered(alias, alias, strlen(alias)); CopyISOLatin1Lowered(font_name, lexToken, strlen(lexToken)); if (!FontFileAddFontAlias (dir, alias, font_name)) |