Apply by doing: cd /usr/XF4 patch -p0 < 017_font.patch Then rebuild and install X: cd /usr/obj lndir /usr/XF4 make build Index: xc/lib/font/fontfile/dirfile.c =================================================================== RCS file: /cvs/XF4/xc/lib/font/fontfile/dirfile.c,v retrieving revision 1.1.1.3 retrieving revision 1.1.1.3.6.2 diff -u -p -r1.1.1.3 -r1.1.1.3.6.2 --- xc/lib/font/fontfile/dirfile.c 19 Jan 2002 11:06:06 -0000 1.1.1.3 +++ xc/lib/font/fontfile/dirfile.c 13 Feb 2004 07:50:51 -0000 1.1.1.3.6.2 @@ -68,6 +68,9 @@ FontFileReadDirectory (char *directory, FontDirectoryPtr dir = NullFontDirectory; + if (strlen(directory) + 1 + sizeof(FontDirFile) > sizeof(dir_file)) + return BadFontPath; + #ifdef FONTDIRATTRIB /* Check for font directory attributes */ #ifndef __EMX__ @@ -154,6 +157,9 @@ FontFileDirectoryChanged(FontDirectoryPt char dir_file[MAXFONTFILENAMELEN]; struct stat statb; + if (strlen(dir->directory) + sizeof(FontDirFile) > sizeof(dir_file)) + return FALSE; + strcpy (dir_file, dir->directory); strcat (dir_file, FontDirFile); if (stat (dir_file, &statb) == -1) @@ -202,6 +208,8 @@ AddFileNameAliases(FontDirectoryPtr dir) continue; len = strlen (fileName) - renderer->fileSuffixLen; + if (len >= sizeof(copy)) + continue; CopyISOLatin1Lowered (copy, fileName, len); copy[len] = '\0'; name.name = copy; @@ -251,9 +259,13 @@ ReadFontAlias(char *directory, Bool isFi int status = Successful; struct stat statb; + if (strlen(directory) >= sizeof(alias_file)) + return BadFontPath; dir = *pdir; strcpy(alias_file, directory); if (!isFile) { + if (strlen(directory) + 1 + sizeof(FontAliasFile) > sizeof(alias_file)) + return BadFontPath; if (directory[strlen(directory) - 1] != '/') strcat(alias_file, "/"); strcat(alias_file, FontAliasFile); @@ -286,6 +298,10 @@ ReadFontAlias(char *directory, Bool isFi status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(alias)) { + status = BadFontPath; + break; + } strcpy(alias, lexToken); token = lexAlias(file, &lexToken); switch (token) { @@ -302,6 +318,10 @@ ReadFontAlias(char *directory, Bool isFi status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(font_name)) { + status = BadFontPath; + break; + } CopyISOLatin1Lowered(alias, alias, strlen(alias)); CopyISOLatin1Lowered(font_name, lexToken, strlen(lexToken)); if (!FontFileAddFontAlias (dir, alias, font_name)) Index: xc/lib/font/fontfile/encparse.c =================================================================== RCS file: /cvs/XF4/xc/lib/font/fontfile/encparse.c,v retrieving revision 1.1.1.2 retrieving revision 1.1.1.2.6.1 diff -u -p -r1.1.1.2 -r1.1.1.2.6.1 --- xc/lib/font/fontfile/encparse.c 19 Jan 2002 11:06:06 -0000 1.1.1.2 +++ xc/lib/font/fontfile/encparse.c 13 Feb 2004 07:50:51 -0000 1.1.1.2.6.1 @@ -833,6 +833,7 @@ FontEncReallyReallyLoad(const char *char char file_name[MAXFONTFILENAMELEN], encoding_name[MAXFONTNAMELEN], buf[MAXFONTFILENAMELEN]; int count, n; + static char format[24] = ""; /* As we don't really expect to open encodings that often, we don't take the trouble of caching encodings directories. */ @@ -848,8 +849,12 @@ FontEncReallyReallyLoad(const char *char } encoding = NULL; + if (!format[0]) { + sprintf(format, "%%%ds %%%d[^\n]\n", sizeof(encoding_name) - 1, + sizeof(file_name) - 1); + } for(;;) { - count = fscanf(file, "%s %[^\n]\n", encoding_name, file_name); + count = fscanf(file, format, encoding_name, file_name); if(count == EOF) break; if(count != 2) Index: xc/lib/font/fontfile/fontfile.c =================================================================== RCS file: /cvs/XF4/xc/lib/font/fontfile/fontfile.c,v retrieving revision 1.1.1.3 retrieving revision 1.1.1.3.6.1 diff -u -p -r1.1.1.3 -r1.1.1.3.6.1 --- xc/lib/font/fontfile/fontfile.c 19 Jan 2002 11:06:06 -0000 1.1.1.3 +++ xc/lib/font/fontfile/fontfile.c 13 Feb 2004 07:50:51 -0000 1.1.1.3.6.1 @@ -424,11 +424,16 @@ FontFileOpenFont (pointer client, FontPa vals.ranges = ranges; vals.nranges = nranges; - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->OpenScalable) (fpe, pFont, + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->OpenScalable) (fpe, pFont, flags, entry, fileName, &vals, format, fmask, non_cachable_font); + } /* In case rasterizer does something bad because of charset subsetting... */ @@ -497,6 +502,10 @@ FontFileOpenBitmapNCF (FontPathElementPt dir = (FontDirectoryPtr) fpe->private; bitmap = &entry->u.bitmap; + if(!bitmap || !bitmap->renderer->OpenBitmap) + return BadFontName; + if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName)) + return BadFontName; strcpy (fileName, dir->directory); strcat (fileName, bitmap->fileName); ret = (*bitmap->renderer->OpenBitmap) @@ -530,6 +539,10 @@ FontFileGetInfoBitmap (FontPathElementPt dir = (FontDirectoryPtr) fpe->private; bitmap = &entry->u.bitmap; + if (!bitmap || !bitmap->renderer->GetInfoBitmap) + return BadFontName; + if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName)) + return BadFontName; strcpy (fileName, dir->directory); strcat (fileName, bitmap->fileName); ret = (*bitmap->renderer->GetInfoBitmap) (fpe, pFontInfo, entry, fileName); @@ -891,10 +904,15 @@ FontFileListOneFontWithInfo (pointer cli vals.ranges = FontParseRanges(origName, &vals.nranges); ranges = vals.ranges; /* Make a new scaled instance */ - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->GetInfoScalable) - (fpe, *pFontInfo, entry, &tmpName, fileName, &vals); + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->GetInfoScalable) + (fpe, *pFontInfo, entry, &tmpName, fileName, &vals); + } if (ranges) xfree(ranges); } } @@ -931,10 +949,15 @@ FontFileListOneFontWithInfo (pointer cli bc = &entry->u.bc; entry = bc->entry; /* Make a new scaled instance */ - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->GetInfoScalable) + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->GetInfoScalable) (fpe, *pFontInfo, entry, tmpName, fileName, &bc->vals); + } break; #endif default: Index: xc-old/lib/font/fontfile/dirfile.c =================================================================== RCS file: /cvs/XF4/xc-old/lib/font/fontfile/dirfile.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.10.2 diff -u -p -r1.1.1.1 -r1.1.1.1.10.2 --- xc-old/lib/font/fontfile/dirfile.c 18 Feb 2001 16:08:19 -0000 1.1.1.1 +++ xc-old/lib/font/fontfile/dirfile.c 13 Feb 2004 07:50:51 -0000 1.1.1.1.10.2 @@ -73,6 +73,9 @@ FontFileReadDirectory (directory, pdir) FontDirectoryPtr dir = NullFontDirectory; + if (strlen(directory) + 1 + sizeof(FontDirFile) > sizeof(dir_file)) + return BadFontPath; + #ifdef FONTDIRATTRIB /* Check for font directory attributes */ #ifndef __EMX__ @@ -160,6 +163,9 @@ FontFileDirectoryChanged(dir) char dir_file[MAXFONTFILENAMELEN]; struct stat statb; + if (strlen(dir->directory) + sizeof(FontDirFile) > sizeof(dir_file)) + return FALSE; + strcpy (dir_file, dir->directory); strcat (dir_file, FontDirFile); if (stat (dir_file, &statb) == -1) @@ -209,6 +215,8 @@ AddFileNameAliases(dir) continue; len = strlen (fileName) - renderer->fileSuffixLen; + if (len >= sizeof(copy)) + continue; CopyISOLatin1Lowered (copy, fileName, len); copy[len] = '\0'; name.name = copy; @@ -263,6 +271,8 @@ ReadFontAlias(directory, isFile, pdir) int status = Successful; struct stat statb; + if (strlen(directory) >= sizeof(alias_file)) + return BadFontPath; dir = *pdir; strcpy(alias_file, directory); if (!isFile) { @@ -298,6 +308,10 @@ ReadFontAlias(directory, isFile, pdir) status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(alias)) { + status = BadFontPath; + break; + } strcpy(alias, lexToken); token = lexAlias(file, &lexToken); switch (token) { @@ -314,6 +328,10 @@ ReadFontAlias(directory, isFile, pdir) status = AllocError; break; case NAME: + if (strlen(lexToken) >= sizeof(font_name)) { + status = BadFontPath; + break; + } CopyISOLatin1Lowered((unsigned char *) alias, (unsigned char *) alias, strlen(alias)); Index: xc-old/lib/font/fontfile/fontfile.c =================================================================== RCS file: /cvs/XF4/xc-old/lib/font/fontfile/fontfile.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.10.1 diff -u -p -r1.1.1.1 -r1.1.1.1.10.1 --- xc-old/lib/font/fontfile/fontfile.c 18 Feb 2001 16:08:20 -0000 1.1.1.1 +++ xc-old/lib/font/fontfile/fontfile.c 13 Feb 2004 07:50:51 -0000 1.1.1.1.10.1 @@ -438,11 +438,16 @@ FontFileOpenFont (client, fpe, flags, na vals.ranges = ranges; vals.nranges = nranges; - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->OpenScalable) (fpe, pFont, + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->OpenScalable) (fpe, pFont, flags, entry, fileName, &vals, format, fmask, non_cachable_font); + } /* In case rasterizer does something bad because of charset subsetting... */ @@ -517,6 +522,10 @@ FontFileOpenBitmapNCF (fpe, pFont, flags dir = (FontDirectoryPtr) fpe->private; bitmap = &entry->u.bitmap; + if(!bitmap || !bitmap->renderer->OpenBitmap) + return BadFontName; + if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName)) + return BadFontName; strcpy (fileName, dir->directory); strcat (fileName, bitmap->fileName); ret = (*bitmap->renderer->OpenBitmap) @@ -553,6 +562,10 @@ FontFileGetInfoBitmap (fpe, pFontInfo, e dir = (FontDirectoryPtr) fpe->private; bitmap = &entry->u.bitmap; + if (!bitmap || !bitmap->renderer->GetInfoBitmap) + return BadFontName; + if (strlen(dir->directory) + strlen(bitmap->fileName) >= sizeof(fileName)) + return BadFontName; strcpy (fileName, dir->directory); strcat (fileName, bitmap->fileName); ret = (*bitmap->renderer->GetInfoBitmap) (fpe, pFontInfo, entry, fileName); @@ -936,10 +949,15 @@ FontFileListOneFontWithInfo (client, fpe vals.ranges = FontParseRanges(origName, &vals.nranges); ranges = vals.ranges; /* Make a new scaled instance */ - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->GetInfoScalable) - (fpe, *pFontInfo, entry, &tmpName, fileName, &vals); + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->GetInfoScalable) + (fpe, *pFontInfo, entry, &tmpName, fileName, &vals); + } if (ranges) xfree(ranges); } } @@ -976,10 +994,15 @@ FontFileListOneFontWithInfo (client, fpe bc = &entry->u.bc; entry = bc->entry; /* Make a new scaled instance */ - strcpy (fileName, dir->directory); - strcat (fileName, scalable->fileName); - ret = (*scalable->renderer->GetInfoScalable) + if (strlen(dir->directory) + strlen(scalable->fileName) >= + sizeof(fileName)) { + ret = BadFontName; + } else { + strcpy (fileName, dir->directory); + strcat (fileName, scalable->fileName); + ret = (*scalable->renderer->GetInfoScalable) (fpe, *pFontInfo, entry, tmpName, fileName, &bc->vals); + } break; #endif default: