View Issue Details

IDProjectCategoryView StatusLast Update
0031143FPCFCLpublic2017-03-05 06:17
ReporterOndrej PokornyAssigned ToMichael Van Canneyt 
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Product Version3.1.1Product Build 
Target Version3.2.0Fixed in Version3.1.1 
Summary0031143: fcl-pdf: range check error in TFontSubsetter.SaveToStream
DescriptionThere is a range bug left in fpTTFSubsetter in TFontSubsetter.SaveToStream -> WriteInt32(head, checksum);

checksum is an int64 value!
Additional InformationBacktrace:

0 fpc_raiseexception(0xc9, 0x5cc378, 0x2cef630) at ..\inc\except.inc:158
1 RUNERRORTOEXCEPT(201, 0x5cc378, 0x2cef630) at ..\objpas\sysutils\sysutils.inc:441
2 HANDLEERRORADDRFRAME(201, 0x5cc378, 0x2cef630) at ..\inc\system.inc:1144
3 HANDLEERRORADDRFRAMEIND(201, 0x5cc378, 0x2cef630) at ..\inc\system.inc:1161
4 fpc_rangeerror at ..\inc\system.inc:755
5 SAVETOSTREAM(0x2463640, 0x25ed470) at packages\fcl-pdf\src\fpttfsubsetter.pp:1095
6 GENERATESUBSETFONT(0x25cdd10) at packages\fcl-pdf\src\fppdf.pp:1400
7 CREATEFONTENTRIES(0x25d95a0) at packages\fcl-pdf\src\fppdf.pp:5088
8 SAVETOSTREAM(0x25d95a0, 0x2458048) at packages\fcl-pdf\src\fppdf.pp:5128
TagsNo tags attached.
Fixed in Revision35519
FPCOldBugId
FPCTarget
Attached Files
  • fpttfsubsetter-rangecheckerror-1.patch (468 bytes)
    Index: packages/fcl-pdf/src/fpttfsubsetter.pp
    ===================================================================
    --- packages/fcl-pdf/src/fpttfsubsetter.pp	(revision 35175)
    +++ packages/fcl-pdf/src/fpttfsubsetter.pp	(working copy)
    @@ -1092,7 +1092,7 @@
     
       // update head.ChecksumAdjustment field
       head.Seek(8, soBeginning);
    -  WriteInt32(head, checksum);
    +  WriteInt32(head, Int32(checksum));
     
       // write table bodies
       WriteTableBodies(AStream, tables);
    

Activities

Ondrej Pokorny

2016-12-21 11:14

developer   ~0096988

Furthermore the objects (head, hhea, [...], tables) in TFontSubsetter.SaveToStream aren't covered with a try-finally block. As a result of this exception, there is a memory leak.

Ondrej Pokorny

2017-01-10 11:24

developer   ~0097391

Ping: a simple cast to Int32 solves the issue for me (see attached patch).

Ondrej Pokorny

2017-01-10 11:25

developer  

fpttfsubsetter-rangecheckerror-1.patch (468 bytes)
Index: packages/fcl-pdf/src/fpttfsubsetter.pp
===================================================================
--- packages/fcl-pdf/src/fpttfsubsetter.pp	(revision 35175)
+++ packages/fcl-pdf/src/fpttfsubsetter.pp	(working copy)
@@ -1092,7 +1092,7 @@
 
   // update head.ChecksumAdjustment field
   head.Seek(8, soBeginning);
-  WriteInt32(head, checksum);
+  WriteInt32(head, Int32(checksum));
 
   // write table bodies
   WriteTableBodies(AStream, tables);

Michael Van Canneyt

2017-03-04 15:24

administrator   ~0098629

Finally got around to applying this, thank you very much!

Ondrej Pokorny

2017-03-05 06:17

developer   ~0098643

Thank you!

Issue History

Date Modified Username Field Change
2016-12-20 16:03 Ondrej Pokorny New Issue
2016-12-21 11:14 Ondrej Pokorny Note Added: 0096988
2017-01-10 11:24 Ondrej Pokorny Note Added: 0097391
2017-01-10 11:25 Ondrej Pokorny File Added: fpttfsubsetter-rangecheckerror-1.patch
2017-01-30 08:42 Michael Van Canneyt Assigned To => Michael Van Canneyt
2017-01-30 08:42 Michael Van Canneyt Status new => assigned
2017-03-04 15:24 Michael Van Canneyt Fixed in Revision => 35519
2017-03-04 15:24 Michael Van Canneyt Note Added: 0098629
2017-03-04 15:24 Michael Van Canneyt Status assigned => resolved
2017-03-04 15:24 Michael Van Canneyt Fixed in Version => 3.1.1
2017-03-04 15:24 Michael Van Canneyt Resolution open => fixed
2017-03-04 15:24 Michael Van Canneyt Target Version => 3.2.0
2017-03-05 06:17 Ondrej Pokorny Note Added: 0098643
2017-03-05 06:17 Ondrej Pokorny Status resolved => closed