ra8_stbtt_guard.c

Go to the documentation of this file.

 
#include "ra8_stbtt_guard.h"
 
#include <stddef.h>
#include <stdint.h>
 
#include "ra8_attributes.h"

typedef enum : uint8_t {
  k_sfnt_offset_table_bytes = 12U, 
  k_sfnt_num_tables_off     = 4U,  
  k_sfnt_table_record_bytes = 16U, 
  k_sfnt_record_tag_off     = 0U,  
  k_sfnt_record_offset_off  = 8U,  
  k_sfnt_record_length_off  = 12U, 
} sfnt_layout_t;

typedef enum : uint32_t {
  k_sfnt_tag_cmap = 0x636D6170U, 
  k_sfnt_tag_head = 0x68656164U, 
  k_sfnt_tag_maxp = 0x6D617870U, 
} sfnt_tag_t;

typedef enum : uint8_t {
  k_cmap_header_bytes   = 4U,  
  k_cmap_num_tables_off = 2U,  
  k_cmap_record_bytes   = 8U,  
  k_head_loc_format_end = 52U, 
  k_maxp_num_glyphs_end = 6U,  
} sfnt_internal_layout_t;

typedef enum : uint8_t {
  k_sfnt_shift_8  = 8U,  
  k_sfnt_shift_16 = 16U, 
  k_sfnt_shift_24 = 24U, 
} sfnt_shift_t;

RA8_INTERNAL
static uint16_t internal_rd_be_u16(const uint8_t* p)
{
  return (uint16_t)(((uint32_t)p[0] << k_sfnt_shift_8) | (uint32_t)p[1]);
}

RA8_INTERNAL
static uint32_t internal_rd_be_u32(const uint8_t* p)
{
  return ((uint32_t)p[0] << k_sfnt_shift_24) | ((uint32_t)p[1] << k_sfnt_shift_16) |
         ((uint32_t)p[2] << k_sfnt_shift_8) | (uint32_t)p[3];
}

RA8_INTERNAL
static bool internal_table_internal_in_bounds(const uint8_t* data,
                                              uint64_t       buf_len,
                                              uint32_t       tag,
                                              uint64_t       t_off)
{
  if (tag == (uint32_t)k_sfnt_tag_cmap) {
    if ((t_off + (uint64_t)k_cmap_header_bytes) > buf_len) {
      return false;
    }
    const uint32_t sub_tables =
      internal_rd_be_u16(&data[(size_t)(t_off + (uint64_t)k_cmap_num_tables_off)]);
    const uint64_t sub_end = t_off + (uint64_t)k_cmap_header_bytes +
                             ((uint64_t)sub_tables * (uint64_t)k_cmap_record_bytes);
    return sub_end <= buf_len;
  }
  if (tag == (uint32_t)k_sfnt_tag_head) {
    return (t_off + (uint64_t)k_head_loc_format_end) <= buf_len;
  }
  if (tag == (uint32_t)k_sfnt_tag_maxp) {
    return (t_off + (uint64_t)k_maxp_num_glyphs_end) <= buf_len;
  }
  return true;
}
 
bool ra8_stbtt_sfnt_dir_in_bounds(const uint8_t* data, size_t len, uint32_t fontstart)
{
  if (data == nullptr) {
    return false;
  }
 
  const uint64_t buf_len = (uint64_t)len;
  const uint64_t start   = (uint64_t)fontstart;
 
  /* (1) The 12-byte offset table must lie within the buffer before we may
   * read numTables from it. Computed in uint64_t so a hostile fontstart
   * (up to UINT32_MAX) cannot wrap the sum. */
  if ((start + (uint64_t)k_sfnt_offset_table_bytes) > buf_len) {
    return false;
  }
  const uint32_t num_tables =
    internal_rd_be_u16(&data[(size_t)(start + (uint64_t)k_sfnt_num_tables_off)]);
 
  /* (2) The whole table directory (num_tables records of 16 bytes) must fit.
   * num_tables is a uint16 (<= 65535), so the product is bounded. */
  const uint64_t dir_end = start + (uint64_t)k_sfnt_offset_table_bytes +
                           ((uint64_t)num_tables * (uint64_t)k_sfnt_table_record_bytes);
  if (dir_end > buf_len) {
    return false;
  }
 
  /* (3) Every table's declared [offset, offset + length) extent must fit, and
   * (4) the reads stbtt_InitFont makes INSIDE cmap / head / maxp must also stay
   * in-bounds -- the top-level extent alone does not bound cmap's internal
   * 8 * numTables sub-directory walk. Both record fields are uint32, so the
   * sum is at most 0x1FFFFFFFE and cannot overflow uint64_t. The record-header
   * reads at rec+0 / rec+8 / rec+12 are proven in-bounds by check (2) above
   * (rec + 16 <= dir_end <= len). */
  for (uint32_t i = 0U; i < num_tables; ++i) {
    const uint64_t rec = start + (uint64_t)k_sfnt_offset_table_bytes +
                         ((uint64_t)i * (uint64_t)k_sfnt_table_record_bytes);
    const uint32_t tag = internal_rd_be_u32(&data[(size_t)(rec + (uint64_t)k_sfnt_record_tag_off)]);
    const uint64_t t_off =
      (uint64_t)internal_rd_be_u32(&data[(size_t)(rec + (uint64_t)k_sfnt_record_offset_off)]);
    const uint64_t t_len =
      (uint64_t)internal_rd_be_u32(&data[(size_t)(rec + (uint64_t)k_sfnt_record_length_off)]);
    if ((t_off + t_len) > buf_len) {
      return false;
    }
    if (!internal_table_internal_in_bounds(data, buf_len, tag, t_off)) {
      return false;
    }
  }
 
  return true;
}