Fix some memory errors

diff --git a/ttf2png.c b/ttf2png.c
index 1b1106a9f03bff035d4b9e2dc53e260840ce668f..7ef19e14860d9590e8e748dfccde291c0779c1f1 100644 (file)
--- a/ttf2png.c
+++ b/ttf2png.c
@@ -63,9 +63,10 @@ typedef struct sFont
 
 unsigned round_to_pot(unsigned);
 void usage();
-void init_font(Font *, FT_Face, unsigned, unsigned, int);
-void render_grid(Font *, unsigned, unsigned, unsigned, int);
-void render_packed(Font *);
+void *alloc_image_data(size_t, size_t);
+int init_font(Font *, FT_Face, unsigned, unsigned, int);
+int render_grid(Font *, unsigned, unsigned, unsigned, int);
+int render_packed(Font *);
 int save_defs(const char *, const Font *);
 int save_png(const char *, const Image *, char);
 
@@ -235,23 +236,33 @@ int main(int argc, char **argv)
        }
 
        font.size = size;
-       init_font(&font, face, begin, end, autohinter);
+       err = init_font(&font, face, begin, end, autohinter);
+       if(err)
+               return 1;
+
        if(pack)
-               render_packed(&font);
+               err = render_packed(&font);
        else
-               render_grid(&font, cellw, cellh, cpl, seq);
+               err = render_grid(&font, cellw, cellh, cpl, seq);
+       if(err)
+               return 1;
+
        if(invert)
        {
                for(i=0; (unsigned)i<font.image.w*font.image.h; ++i)
                        font.image.data[i] = 255-font.image.data[i];
        }
-       save_png(out_fn, &font.image, alpha);
+       err = save_png(out_fn, &font.image, alpha);
+       if(err)
+               return 1;
+
        if(def_fn)
                save_defs(def_fn, &font);
 
        for(i=0; (unsigned)i<font.n_glyphs; ++i)
                free(font.glyphs[i].image.data);
        free(font.glyphs);
+       free(font.kerning);
        free(font.image.data);
 
        FT_Done_Face(face);
@@ -296,7 +307,31 @@ void usage()
                "  -h  Print this message\n");
 }
 
-void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int autohinter)
+void *alloc_image_data(size_t a, size_t b)
+{
+       void *ptr;
+
+       /* Carry out the multiplication manually so we can check for overflow. */
+       while(b>1)
+       {
+               size_t c = a;
+               a *= 2;
+               if(b&1)
+                       a += c;
+               if(a<c)
+               {
+                       fprintf(stderr, "Cannot allocate %d kbytes of memory for image\n", c/1024*b);
+                       return NULL;
+               }
+               b /= 2;
+       }
+       ptr = malloc(a);
+       if(!ptr)
+               fprintf(stderr, "Cannot allocate %d kbytes of memory for image\n", a/1024*b);
+       return ptr;
+}
+
+int init_font(Font *font, FT_Face face, unsigned first, unsigned last, int autohinter)
 {
        unsigned i, j;
        unsigned size = 0;
@@ -350,6 +385,11 @@ void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int auto
                glyph->image.w = bmp->width;
                glyph->image.h = bmp->rows;
                glyph->image.data = (char *)malloc(bmp->width*bmp->rows);
+               if(!glyph->image.data)
+               {
+                       fprintf(stderr, "Cannot allocate %d bytes of memory for glyph\n", bmp->width*bmp->rows);
+                       return -1;
+               }
                glyph->offset_x = face->glyph->bitmap_left;
                glyph->offset_y = face->glyph->bitmap_top-bmp->rows;
                glyph->advance = (int)(face->glyph->advance.x+32)/64;
@@ -402,9 +442,11 @@ void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int auto
 
        if(verbose>=1)
                printf("Loaded %d kerning pairs\n", font->n_kerning);
+
+       return 0;
 }
 
-void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int seq)
+int render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int seq)
 {
        unsigned i;
        int      top = 0, bot = 0;
@@ -471,7 +513,9 @@ void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int s
        font->image.w = round_to_pot(cpl*cellw);
        font->image.h = round_to_pot((last-first+cpl)/cpl*cellh);
 
-       font->image.data = (char *)malloc(font->image.w*font->image.h);
+       font->image.data = (char *)alloc_image_data(font->image.w, font->image.h);
+       if(!font->image.data)
+               return -1;
        memset(font->image.data, 255, font->image.w*font->image.h);
 
        for(i=0; i<font->n_glyphs; ++i)
@@ -504,12 +548,14 @@ void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int s
                        font->image.data[cx+x+(cy+y)*font->image.w] = 255-glyph->image.data[x+y*glyph->image.w];
                }
        }
+
+       return 0;
 }
 
-void render_packed(Font *font)
+int render_packed(Font *font)
 {
        unsigned i;
-       unsigned area = 0;
+       size_t   area = 0;
        char     *used_glyphs;
        unsigned *used_pixels;
        unsigned cx = 0, cy;
@@ -517,7 +563,15 @@ void render_packed(Font *font)
 
        /* Compute the total area occupied by glyphs and padding. */
        for(i=0; i<font->n_glyphs; ++i)
-               area += (font->glyphs[i].image.w+1)*(font->glyphs[i].image.h+1);
+       {
+               size_t a = area+(font->glyphs[i].image.w+1)*(font->glyphs[i].image.h+1);
+               if(a<area)
+               {
+                       fprintf(stderr, "Overflow in counting total glyph area\n");
+                       return -1;
+               }
+               area = a;
+       }
 
        /* Find an image size that's no higher than wide, allowing for some
        imperfections in the packing. */
@@ -533,7 +587,9 @@ void render_packed(Font *font)
        glyphs.  Since glyphs are rectangular and the image is filled starting from
        the top, it's enough to track the number of used pixels at the top of each
        column. */
-       font->image.data = (char *)malloc(font->image.w*font->image.h);
+       font->image.data = (char *)alloc_image_data(font->image.w, font->image.h);
+       if(!font->image.data)
+               return -1;
        memset(font->image.data, 255, font->image.w*font->image.h);
        used_pixels = (unsigned *)malloc(font->image.w*sizeof(unsigned));
        memset(used_pixels, 0, font->image.w*sizeof(unsigned));
@@ -622,6 +678,11 @@ void render_packed(Font *font)
        /* Trim the image to the actually used size, in case the original estimate
        was too pessimistic. */
        font->image.h = round_to_pot(used_h);
+
+       free(used_glyphs);
+       free(used_pixels);
+
+       return 0;
 }
 
 int save_defs(const char *fn, const Font *font)
@@ -699,7 +760,9 @@ int save_png(const char *fn, const Image *image, char alpha)
        rows = (png_byte **)malloc(image->h*sizeof(png_byte *));
        if(alpha)
        {
-               data2 = (png_byte *)malloc(image->w*image->h*2);
+               data2 = (png_byte *)alloc_image_data(image->w*2, image->h);
+               if(!data2)
+                       return -1;
                for(i=0; i<image->w*image->h; ++i)
                {
                        data2[i*2] = 255;