diff options
| author | Akira TAGOH <akira@tagoh.org> | 2017-11-14 20:55:24 +0900 |
|---|---|---|
| committer | Akira TAGOH <akira@tagoh.org> | 2017-11-14 20:55:24 +0900 |
| commit | 2ed243f323e603ac917a236a48b468e9c523da35 (patch) | |
| tree | 061214cef0d5ba1bfc9d13b0d03eb37db3f3df48 /src/fccache.c | |
| parent | 12eb7be46610178c74fbe24ae518e20957cda1ea (diff) | |
Validate cache more carefully
Reject caches when FcPattern isn't a constant.
This is usually unlikely to happen but reported.
I've decided to add more validation since this isn't reproducible
and easy to have a workaround rather than investigating 'why'.
https://bugs.freedesktop.org/show_bug.cgi?id=103237
Diffstat (limited to 'src/fccache.c')
| -rw-r--r-- | src/fccache.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/fccache.c b/src/fccache.c index 6f3c68a..c59ea19 100644 --- a/src/fccache.c +++ b/src/fccache.c @@ -646,7 +646,8 @@ FcCacheOffsetsValid (FcCache *cache) (char *) font > end - sizeof (FcFontSet) || font->elts_offset < 0 || font->elts_offset > end - (char *) font || - font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt)) + font->num > (end - (char *) font - font->elts_offset) / sizeof (FcPatternElt) || + !FcRefIsConst (&font->ref)) return FcFalse; |