Avoid out of bounds crash when reading fonts
CFGAS_FontMgr::RegisterFace() has a GetNames() helper function that
reads font tables. If a font table contains invalid lengths or offsets,
the code will attempt to do an out of bounds read and crash. Check for
this condition and skip the bad font data to avoid this crash.
Bug: 389967361
Change-Id: Ic499687158f2f86f4eb542ff6478a1761e5a608d
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/127890
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Thomas Sepez <tsepez@google.com>
diff --git a/xfa/fgas/font/cfgas_fontmgr.cpp b/xfa/fgas/font/cfgas_fontmgr.cpp
index 48ec7d0..507e09c 100644
--- a/xfa/fgas/font/cfgas_fontmgr.cpp
+++ b/xfa/fgas/font/cfgas_fontmgr.cpp
@@ -449,6 +449,11 @@
continue;
}
+ // Avoid out of bounds crashes if the length and/or offset are wrong.
+ if (static_cast<size_t>(nNameLength) + nNameOffset >= str.size()) {
+ continue;
+ }
+
WideString wsFamily;
for (uint16_t j = 0; j < nNameLength; ++j) {
wchar_t wcTemp = str[nNameOffset + j];
