0ct0pu5/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-12-11 17:00:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

LibGfx/WOFF2: Reject fonts with a compressed size larger than 10MiB

Browse source 
This prevents a potential OOM condition when the header is malformed.
This commit is contained in:
Tim Ledbetter 2023-10-24 07:54:20 +01:00 committed by Andreas Kling
parent af633523af
commit e9be1bcd09
Notes: sideshowbarker 2024-07-17 09:49:48 +09:00 
Author: https://github.com/tcl3
Commit: https://github.com/SerenityOS/serenity/commit/e9be1bcd09
Pull-request: https://github.com/SerenityOS/serenity/pull/21567
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
Tests/LibGfx/TestWOFF2.cpp
View file

@ -20,3 +20,16 @@ TEST_CASE(tolerate_incorrect_sfnt_size)
EXPECT_EQ(font->family(), "Test"_string);
EXPECT_EQ(font->glyph_count(), 4u);
}
TEST_CASE(malformed_woff2)
{
Array test_inputs = {
TEST_INPUT("woff2/incorrect_compressed_size.woff2"sv)
};
for (auto test_input : test_inputs) {
auto file = MUST(Core::MappedFile::map(test_input));
auto font_or_error = WOFF2::Font::try_load_from_externally_owned_memory(file->bytes());
EXPECT(font_or_error.is_error());
}
}

BIN
Tests/LibGfx/test-inputs/woff2/incorrect_compressed_size.woff2 Normal file
View file

Binary file not shown.

2
Userland/Libraries/LibGfx/Font/WOFF2/Font.cpp
View file

@ -859,6 +859,8 @@ ErrorOr<NonnullRefPtr<Font>> Font::try_load_from_externally_owned_memory(Seekabl
static constexpr size_t MAX_BUFFER_SIZE = 10 * MiB;
if (header.length > TRY(stream.size()))
return Error::from_string_literal("Invalid WOFF length");
if (header.total_compressed_size > MAX_BUFFER_SIZE)
return Error::from_string_literal("Compressed font is more than 10 MiB");
if (header.meta_length == 0 && header.meta_offset != 0)
return Error::from_string_literal("Invalid WOFF meta block offset");
if (header.priv_length == 0 && header.priv_offset != 0)