Attachment 302425 Details for Bug 441722 – Poppler type-checking patch from kees cook

[patch] Poppler type-checking patch from kees cook

poppler-font-ref.patch (text/plain), 4.71 KB, created by Lubomir Kundrak on 2008-04-15 08:49:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2008-04-15 08:49:08 UTC

Size: 4.71 KB

patch

obsolete

># https://launchpad.net/bugs/122396
># Peform type checking before accessing union members.
># Kees Cook <kees@canonical.com>
>
>diff -Nur poppler-0.6/poppler/Object.h poppler-0.6.new/poppler/Object.h
>--- poppler-0.6/poppler/Object.h	2008-04-07 17:44:03.000000000 -0700
>+++ poppler-0.6.new/poppler/Object.h	2008-04-07 17:44:49.000000000 -0700
>@@ -66,17 +66,18 @@
> //------------------------------------------------------------------------
> 
> #ifdef DEBUG_MEM
>-#define initObj(t) ++numAlloc[type = t]
>+#define initObj(t) zeroUnion(); ++numAlloc[type = t]
> #else
>-#define initObj(t) type = t
>+#define initObj(t) zeroUnion(); type = t
> #endif
> 
> class Object {
> public:
>-
>+  // attempt to clear the anonymous union
>+  void zeroUnion() { this->name = NULL; }
>   // Default constructor.
>   Object():
>-    type(objNone) {}
>+    type(objNone) { zeroUnion(); }
> 
>   // Initialize an object.
>   Object *initBool(GBool boolnA)
>@@ -223,16 +224,16 @@
> #include "Array.h"
> 
> inline int Object::arrayGetLength()
>-  { return array->getLength(); }
>+  { if (type != objArray) return 0; return array->getLength(); }
> 
> inline void Object::arrayAdd(Object *elem)
>-  { array->add(elem); }
>+  { if (type == objArray) array->add(elem); }
> 
> inline Object *Object::arrayGet(int i, Object *obj)
>-  { return array->get(i, obj); }
>+  { if (type != objArray) return obj->initNull(); return array->get(i, obj); }
> 
> inline Object *Object::arrayGetNF(int i, Object *obj)
>-  { return array->getNF(i, obj); }
>+  { if (type != objArray) return obj->initNull(); return array->getNF(i, obj); }
> 
> //------------------------------------------------------------------------
> // Dict accessors.
>@@ -241,34 +242,34 @@
> #include "Dict.h"
> 
> inline int Object::dictGetLength()
>-  { return dict->getLength(); }
>+  { if (type != objDict) return 0; return dict->getLength(); }
> 
> inline void Object::dictAdd(char *key, Object *val)
>-  { dict->add(key, val); }
>+  { if (type == objDict) dict->add(key, val); }
> 
> inline void Object::dictSet(char *key, Object *val)
>- 	{ dict->set(key, val); }
>+ 	{ if (type == objDict) dict->set(key, val); }
> 
> inline GBool Object::dictIs(char *dictType)
>-  { return dict->is(dictType); }
>+  { return (type == objDict) && dict->is(dictType); }
> 
> inline GBool Object::isDict(char *dictType)
>-  { return type == objDict && dictIs(dictType); }
>+  { return (type == objDict) && dictIs(dictType); }
> 
> inline Object *Object::dictLookup(char *key, Object *obj)
>-  { return dict->lookup(key, obj); }
>+  { if (type != objDict) return obj->initNull(); return dict->lookup(key, obj); }
> 
> inline Object *Object::dictLookupNF(char *key, Object *obj)
>-  { return dict->lookupNF(key, obj); }
>+  { if (type != objDict) return obj->initNull(); return dict->lookupNF(key, obj); }
> 
> inline char *Object::dictGetKey(int i)
>-  { return dict->getKey(i); }
>+  { if (type != objDict) return NULL; return dict->getKey(i); }
> 
> inline Object *Object::dictGetVal(int i, Object *obj)
>-  { return dict->getVal(i, obj); }
>+  { if (type != objDict) return obj->initNull(); return dict->getVal(i, obj); }
> 
> inline Object *Object::dictGetValNF(int i, Object *obj)
>-  { return dict->getValNF(i, obj); }
>+  { if (type != objDict) return obj->initNull(); return dict->getValNF(i, obj); }
> 
> //------------------------------------------------------------------------
> // Stream accessors.
>@@ -277,33 +278,33 @@
> #include "Stream.h"
> 
> inline GBool Object::streamIs(char *dictType)
>-  { return stream->getDict()->is(dictType); }
>+  { return (type == objStream) && stream->getDict()->is(dictType); }
> 
> inline GBool Object::isStream(char *dictType)
>-  { return type == objStream && streamIs(dictType); }
>+  { return (type == objStream) && streamIs(dictType); }
> 
> inline void Object::streamReset()
>-  { stream->reset(); }
>+  { if (type == objStream) stream->reset(); }
> 
> inline void Object::streamClose()
>-  { stream->close(); }
>+  { if (type == objStream) stream->close(); }
> 
> inline int Object::streamGetChar()
>-  { return stream->getChar(); }
>+  { if (type != objStream) return EOF; return stream->getChar(); }
> 
> inline int Object::streamLookChar()
>-  { return stream->lookChar(); }
>+  { if (type != objStream) return EOF; return stream->lookChar(); }
> 
> inline char *Object::streamGetLine(char *buf, int size)
>-  { return stream->getLine(buf, size); }
>+  { if (type != objStream) return NULL; return stream->getLine(buf, size); }
> 
> inline Guint Object::streamGetPos()
>-  { return stream->getPos(); }
>+  { if (type != objStream) return 0; return stream->getPos(); }
> 
> inline void Object::streamSetPos(Guint pos, int dir)
>-  { stream->setPos(pos, dir); }
>+  { if (type == objStream) stream->setPos(pos, dir); }
> 
> inline Dict *Object::streamGetDict()
>-  { return stream->getDict(); }
>+  { if (type != objStream) return NULL; return stream->getDict(); }
> 
> #endif

Actions: View | Diff

Attachments on bug 441722: 301852 | 302425