diff options
Diffstat (limited to 'src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh')
-rw-r--r-- | src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh | 185 |
1 files changed, 157 insertions, 28 deletions
diff --git a/src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh b/src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh index 7859c6a2c6..408649c768 100644 --- a/src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh +++ b/src/3rdparty/harfbuzz-ng/src/hb-sanitize.hh @@ -73,7 +73,7 @@ * === The sanitize() contract === * * The sanitize() method of each object type shall return true if it's safe to - * call other methods of the object, and false otherwise. + * call other methods of the object, and %false otherwise. * * Note that what sanitize() checks for might align with what the specification * describes as valid table data, but does not have to be. In particular, we @@ -105,7 +105,7 @@ #define HB_SANITIZE_MAX_EDITS 32 #endif #ifndef HB_SANITIZE_MAX_OPS_FACTOR -#define HB_SANITIZE_MAX_OPS_FACTOR 8 +#define HB_SANITIZE_MAX_OPS_FACTOR 64 #endif #ifndef HB_SANITIZE_MAX_OPS_MIN #define HB_SANITIZE_MAX_OPS_MIN 16384 @@ -113,39 +113,66 @@ #ifndef HB_SANITIZE_MAX_OPS_MAX #define HB_SANITIZE_MAX_OPS_MAX 0x3FFFFFFF #endif +#ifndef HB_SANITIZE_MAX_SUBTABLES +#define HB_SANITIZE_MAX_SUBTABLES 0x4000 +#endif struct hb_sanitize_context_t : hb_dispatch_context_t<hb_sanitize_context_t, bool, HB_DEBUG_SANITIZE> { hb_sanitize_context_t () : - debug_depth (0), start (nullptr), end (nullptr), - max_ops (0), + length (0), + max_ops (0), max_subtables (0), + recursion_depth (0), writable (false), edit_count (0), blob (nullptr), num_glyphs (65536), - num_glyphs_set (false) {} + num_glyphs_set (false), + lazy_some_gpos (false) {} const char *get_name () { return "SANITIZE"; } template <typename T, typename F> bool may_dispatch (const T *obj HB_UNUSED, const F *format) - { return format->sanitize (this); } + { + return format->sanitize (this) && + hb_barrier (); + } static return_t default_return_value () { return true; } static return_t no_dispatch_return_value () { return false; } bool stop_sublookup_iteration (const return_t r) const { return !r; } + bool visit_subtables (unsigned count) + { + max_subtables += count; + return max_subtables < HB_SANITIZE_MAX_SUBTABLES; + } + private: template <typename T, typename ...Ts> auto _dispatch (const T &obj, hb_priority<1>, Ts&&... ds) HB_AUTO_RETURN - ( obj.sanitize (this, hb_forward<Ts> (ds)...) ) + ( obj.sanitize (this, std::forward<Ts> (ds)...) ) template <typename T, typename ...Ts> auto _dispatch (const T &obj, hb_priority<0>, Ts&&... ds) HB_AUTO_RETURN - ( obj.dispatch (this, hb_forward<Ts> (ds)...) ) + ( obj.dispatch (this, std::forward<Ts> (ds)...) ) public: template <typename T, typename ...Ts> auto dispatch (const T &obj, Ts&&... ds) HB_AUTO_RETURN - ( _dispatch (obj, hb_prioritize, hb_forward<Ts> (ds)...) ) + ( _dispatch (obj, hb_prioritize, std::forward<Ts> (ds)...) ) + + hb_sanitize_context_t (hb_blob_t *b) : hb_sanitize_context_t () + { + init (b); + if (blob) + start_processing (); + } + + ~hb_sanitize_context_t () + { + if (blob) + end_processing (); + } void init (hb_blob_t *b) { @@ -171,11 +198,15 @@ struct hb_sanitize_context_t : const char *obj_start = (const char *) obj; if (unlikely (obj_start < this->start || this->end <= obj_start)) + { this->start = this->end = nullptr; + this->length = 0; + } else { this->start = obj_start; this->end = obj_start + hb_min (size_t (this->end - obj_start), obj->get_size ()); + this->length = this->end - this->start; } } @@ -183,16 +214,23 @@ struct hb_sanitize_context_t : { this->start = this->blob->data; this->end = this->start + this->blob->length; + this->length = this->end - this->start; assert (this->start <= this->end); /* Must not overflow. */ } void start_processing () { reset_object (); - this->max_ops = hb_max ((unsigned int) (this->end - this->start) * HB_SANITIZE_MAX_OPS_FACTOR, - (unsigned) HB_SANITIZE_MAX_OPS_MIN); + unsigned m; + if (unlikely (hb_unsigned_mul_overflows (this->end - this->start, HB_SANITIZE_MAX_OPS_FACTOR, &m))) + this->max_ops = HB_SANITIZE_MAX_OPS_MAX; + else + this->max_ops = hb_clamp (m, + (unsigned) HB_SANITIZE_MAX_OPS_MIN, + (unsigned) HB_SANITIZE_MAX_OPS_MAX); this->edit_count = 0; this->debug_depth = 0; + this->recursion_depth = 0; DEBUG_MSG_LEVEL (SANITIZE, start, 0, +1, "start [%p..%p] (%lu bytes)", @@ -209,23 +247,57 @@ struct hb_sanitize_context_t : hb_blob_destroy (this->blob); this->blob = nullptr; this->start = this->end = nullptr; + this->length = 0; } unsigned get_edit_count () { return edit_count; } + + bool check_ops(unsigned count) + { + /* Avoid underflow */ + if (unlikely (this->max_ops < 0 || count >= (unsigned) this->max_ops)) + { + this->max_ops = -1; + return false; + } + this->max_ops -= (int) count; + return true; + } + +#ifndef HB_OPTIMIZE_SIZE + HB_ALWAYS_INLINE +#endif bool check_range (const void *base, unsigned int len) const { const char *p = (const char *) base; - bool ok = !len || - (this->start <= p && - p <= this->end && - (unsigned int) (this->end - p) >= len && - this->max_ops-- > 0); + bool ok = (uintptr_t) (p - this->start) <= this->length && + (unsigned int) (this->end - p) >= len && + ((this->max_ops -= len) > 0); DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, "check_range [%p..%p]" - " (%d bytes) in [%p..%p] -> %s", + " (%u bytes) in [%p..%p] -> %s", + p, p + len, len, + this->start, this->end, + ok ? "OK" : "OUT-OF-RANGE"); + + return likely (ok); + } +#ifndef HB_OPTIMIZE_SIZE + HB_ALWAYS_INLINE +#endif + bool check_range_fast (const void *base, + unsigned int len) const + { + const char *p = (const char *) base; + bool ok = ((uintptr_t) (p - this->start) <= this->length && + (unsigned int) (this->end - p) >= len); + + DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, + "check_range_fast [%p..%p]" + " (%u bytes) in [%p..%p] -> %s", p, p + len, len, this->start, this->end, ok ? "OK" : "OUT-OF-RANGE"); @@ -233,13 +305,32 @@ struct hb_sanitize_context_t : return likely (ok); } +#ifndef HB_OPTIMIZE_SIZE + HB_ALWAYS_INLINE +#endif + bool check_point (const void *base) const + { + const char *p = (const char *) base; + bool ok = (uintptr_t) (p - this->start) <= this->length; + + DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, + "check_point [%p]" + " in [%p..%p] -> %s", + p, + this->start, this->end, + ok ? "OK" : "OUT-OF-RANGE"); + + return likely (ok); + } + template <typename T> bool check_range (const T *base, unsigned int a, unsigned int b) const { - return !hb_unsigned_mul_overflows (a, b) && - this->check_range (base, a * b); + unsigned m; + return !hb_unsigned_mul_overflows (a, b, &m) && + this->check_range (base, m); } template <typename T> @@ -248,8 +339,23 @@ struct hb_sanitize_context_t : unsigned int b, unsigned int c) const { - return !hb_unsigned_mul_overflows (a, b) && - this->check_range (base, a * b, c); + unsigned m; + return !hb_unsigned_mul_overflows (a, b, &m) && + this->check_range (base, m, c); + } + + template <typename T> + HB_ALWAYS_INLINE + bool check_array_sized (const T *base, unsigned int len, unsigned len_size) const + { + if (len_size >= 4) + { + if (unlikely (hb_unsigned_mul_overflows (len, hb_static_size (T), &len))) + return false; + } + else + len = len * hb_static_size (T); + return this->check_range (base, len); } template <typename T> @@ -263,12 +369,32 @@ struct hb_sanitize_context_t : unsigned int a, unsigned int b) const { - return this->check_range (base, a, b, hb_static_size (T)); + return this->check_range (base, hb_static_size (T), a, b); + } + + bool check_start_recursion (int max_depth) + { + if (unlikely (recursion_depth >= max_depth)) return false; + return ++recursion_depth; + } + + bool end_recursion (bool result) + { + recursion_depth--; + return result; } template <typename Type> +#ifndef HB_OPTIMIZE_SIZE + HB_ALWAYS_INLINE +#endif bool check_struct (const Type *obj) const - { return likely (this->check_range (obj, obj->min_size)); } + { + if (sizeof (uintptr_t) == sizeof (uint32_t)) + return likely (this->check_range_fast (obj, obj->min_size)); + else + return likely (this->check_point ((const char *) obj + obj->min_size)); + } bool may_edit (const void *base, unsigned int len) { @@ -279,7 +405,7 @@ struct hb_sanitize_context_t : this->edit_count++; DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, - "may_edit(%u) [%p..%p] (%d bytes) in [%p..%p] -> %s", + "may_edit(%u) [%p..%p] (%u bytes) in [%p..%p] -> %s", this->edit_count, p, p + len, len, this->start, this->end, @@ -324,13 +450,13 @@ struct hb_sanitize_context_t : { if (edit_count) { - DEBUG_MSG_FUNC (SANITIZE, start, "passed first round with %d edits; going for second round", edit_count); + DEBUG_MSG_FUNC (SANITIZE, start, "passed first round with %u edits; going for second round", edit_count); /* sanitize again to ensure no toe-stepping */ edit_count = 0; sane = t->sanitize (this); if (edit_count) { - DEBUG_MSG_FUNC (SANITIZE, start, "requested %d edits in second round; FAILLING", edit_count); + DEBUG_MSG_FUNC (SANITIZE, start, "requested %u edits in second round; FAILING", edit_count); sane = false; } } @@ -374,15 +500,18 @@ struct hb_sanitize_context_t : return sanitize_blob<Type> (hb_face_reference_table (face, tableTag)); } - mutable unsigned int debug_depth; const char *start, *end; - mutable int max_ops; + unsigned length; + mutable int max_ops, max_subtables; private: + int recursion_depth; bool writable; unsigned int edit_count; hb_blob_t *blob; unsigned int num_glyphs; bool num_glyphs_set; + public: + bool lazy_some_gpos; }; struct hb_sanitize_with_object_t |