commit 38b8b40526a85f33521542e24d1e0c82588efc85
author Behdad Esfahbod <behdad@behdad.org> Tue Aug 27 11:44:09 2013 -0400
committer Behdad Esfahbod <behdad@behdad.org> Tue Aug 27 11:46:07 2013 -0400
tree 94d59eeacd4d68ac94925456638c6359d2ae7a60
parent d22548c0e362cc9447557440af9ecbb11badfa78

Fix possible snprintf OOM

https://bugzilla.redhat.com/show_bug.cgi?id=1001645

src/hb-buffer-serialize.cc

diff --git a/src/hb-buffer-serialize.cc b/src/hb-buffer-serialize.cc
index dc47ba7..eac6900 100644
--- a/src/hb-buffer-serialize.cc
+++ b/src/hb-buffer-serialize.cc
@@ -100,10 +100,10 @@
       *p++ = '"';
     }
     else
-      p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint);
+      p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint));
 
     if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_CLUSTERS)) {
-      p += snprintf (p, ARRAY_LENGTH (b) - (p - b), ",\"cl\":%u", info[i].cluster);
+      p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), ",\"cl\":%u", info[i].cluster));
     }
 
     if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_POSITIONS))
@@ -161,21 +161,21 @@
       p += strlen (p);
     }
     else
-      p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint);
+      p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%u", info[i].codepoint));
 
     if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_CLUSTERS)) {
-      p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "=%u", info[i].cluster);
+      p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "=%u", info[i].cluster));
     }
 
     if (!(flags & HB_BUFFER_SERIALIZE_FLAG_NO_POSITIONS))
     {
       if (pos[i].x_offset || pos[i].y_offset)
-	p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "@%d,%d", pos[i].x_offset, pos[i].y_offset);
+	p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "@%d,%d", pos[i].x_offset, pos[i].y_offset));
 
       *p++ = '+';
-      p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%d", pos[i].x_advance);
+      p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), "%d", pos[i].x_advance));
       if (pos->y_advance)
-	p += snprintf (p, ARRAY_LENGTH (b) - (p - b), ",%d", pos[i].y_advance);
+	p += MAX (0, snprintf (p, ARRAY_LENGTH (b) - (p - b), ",%d", pos[i].y_advance));
     }
 
     if (buf_size > (p - b))

src/hb-font-private.hh

diff --git a/src/hb-font-private.hh b/src/hb-font-private.hh
index acea1d7..2b9b544 100644
--- a/src/hb-font-private.hh
+++ b/src/hb-font-private.hh
@@ -426,7 +426,8 @@
   {
     if (get_glyph_name (glyph, s, size)) return;
 
-    snprintf (s, size, "gid%u", glyph);
+    if (size && snprintf (s, size, "gid%u", glyph) < 0)
+      *s = '\0';
   }
 
   /* Parses gidDDD and uniUUUU strings automatically. */

src/hb-shape.cc

diff --git a/src/hb-shape.cc b/src/hb-shape.cc
index c28fdfa..80d8c13 100644
--- a/src/hb-shape.cc
+++ b/src/hb-shape.cc
@@ -181,18 +181,18 @@
   {
     s[len++] = '[';
     if (feature->start)
-      len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->start);
+      len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->start));
     if (feature->end != feature->start + 1) {
       s[len++] = ':';
       if (feature->end != (unsigned int) -1)
-	len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->end);
+	len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->end));
     }
     s[len++] = ']';
   }
   if (feature->value > 1)
   {
     s[len++] = '=';
-    len += snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->value);
+    len += MAX (0, snprintf (s + len, ARRAY_LENGTH (s) - len, "%d", feature->value));
   }
   assert (len < ARRAY_LENGTH (s));
   len = MIN (len, size - 1);