From dce059b659be249e34967837adfdd6c614e011b3 Mon Sep 17 00:00:00 2001
From: Mikko Rasa <tdb@tdb.fi>
Date: Fri, 23 Nov 2012 22:27:48 +0200
Subject: [PATCH] Fix some memory errors

---
 ttf2png.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 78 insertions(+), 15 deletions(-)

diff --git a/ttf2png.c b/ttf2png.c
index 1b1106a..7ef19e1 100644
--- a/ttf2png.c
+++ b/ttf2png.c
@@ -63,9 +63,10 @@ typedef struct sFont
 
 unsigned round_to_pot(unsigned);
 void usage();
-void init_font(Font *, FT_Face, unsigned, unsigned, int);
-void render_grid(Font *, unsigned, unsigned, unsigned, int);
-void render_packed(Font *);
+void *alloc_image_data(size_t, size_t);
+int init_font(Font *, FT_Face, unsigned, unsigned, int);
+int render_grid(Font *, unsigned, unsigned, unsigned, int);
+int render_packed(Font *);
 int save_defs(const char *, const Font *);
 int save_png(const char *, const Image *, char);
 
@@ -235,23 +236,33 @@ int main(int argc, char **argv)
 	}
 
 	font.size = size;
-	init_font(&font, face, begin, end, autohinter);
+	err = init_font(&font, face, begin, end, autohinter);
+	if(err)
+		return 1;
+
 	if(pack)
-		render_packed(&font);
+		err = render_packed(&font);
 	else
-		render_grid(&font, cellw, cellh, cpl, seq);
+		err = render_grid(&font, cellw, cellh, cpl, seq);
+	if(err)
+		return 1;
+
 	if(invert)
 	{
 		for(i=0; (unsigned)i<font.image.w*font.image.h; ++i)
 			font.image.data[i] = 255-font.image.data[i];
 	}
-	save_png(out_fn, &font.image, alpha);
+	err = save_png(out_fn, &font.image, alpha);
+	if(err)
+		return 1;
+
 	if(def_fn)
 		save_defs(def_fn, &font);
 
 	for(i=0; (unsigned)i<font.n_glyphs; ++i)
 		free(font.glyphs[i].image.data);
 	free(font.glyphs);
+	free(font.kerning);
 	free(font.image.data);
 
 	FT_Done_Face(face);
@@ -296,7 +307,31 @@ void usage()
 		"  -h  Print this message\n");
 }
 
-void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int autohinter)
+void *alloc_image_data(size_t a, size_t b)
+{
+	void *ptr;
+
+	/* Carry out the multiplication manually so we can check for overflow. */
+	while(b>1)
+	{
+		size_t c = a;
+		a *= 2;
+		if(b&1)
+			a += c;
+		if(a<c)
+		{
+			fprintf(stderr, "Cannot allocate %d kbytes of memory for image\n", c/1024*b);
+			return NULL;
+		}
+		b /= 2;
+	}
+	ptr = malloc(a);
+	if(!ptr)
+		fprintf(stderr, "Cannot allocate %d kbytes of memory for image\n", a/1024*b);
+	return ptr;
+}
+
+int init_font(Font *font, FT_Face face, unsigned first, unsigned last, int autohinter)
 {
 	unsigned i, j;
 	unsigned size = 0;
@@ -350,6 +385,11 @@ void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int auto
 		glyph->image.w = bmp->width;
 		glyph->image.h = bmp->rows;
 		glyph->image.data = (char *)malloc(bmp->width*bmp->rows);
+		if(!glyph->image.data)
+		{
+			fprintf(stderr, "Cannot allocate %d bytes of memory for glyph\n", bmp->width*bmp->rows);
+			return -1;
+		}
 		glyph->offset_x = face->glyph->bitmap_left;
 		glyph->offset_y = face->glyph->bitmap_top-bmp->rows;
 		glyph->advance = (int)(face->glyph->advance.x+32)/64;
@@ -402,9 +442,11 @@ void init_font(Font *font, FT_Face face, unsigned first, unsigned last, int auto
 
 	if(verbose>=1)
 		printf("Loaded %d kerning pairs\n", font->n_kerning);
+
+	return 0;
 }
 
-void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int seq)
+int render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int seq)
 {
 	unsigned i;
 	int      top = 0, bot = 0;
@@ -471,7 +513,9 @@ void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int s
 	font->image.w = round_to_pot(cpl*cellw);
 	font->image.h = round_to_pot((last-first+cpl)/cpl*cellh);
 
-	font->image.data = (char *)malloc(font->image.w*font->image.h);
+	font->image.data = (char *)alloc_image_data(font->image.w, font->image.h);
+	if(!font->image.data)
+		return -1;
 	memset(font->image.data, 255, font->image.w*font->image.h);
 
 	for(i=0; i<font->n_glyphs; ++i)
@@ -504,12 +548,14 @@ void render_grid(Font *font, unsigned cellw, unsigned cellh, unsigned cpl, int s
 			font->image.data[cx+x+(cy+y)*font->image.w] = 255-glyph->image.data[x+y*glyph->image.w];
 		}
 	}
+
+	return 0;
 }
 
-void render_packed(Font *font)
+int render_packed(Font *font)
 {
 	unsigned i;
-	unsigned area = 0;
+	size_t   area = 0;
 	char     *used_glyphs;
 	unsigned *used_pixels;
 	unsigned cx = 0, cy;
@@ -517,7 +563,15 @@ void render_packed(Font *font)
 
 	/* Compute the total area occupied by glyphs and padding. */
 	for(i=0; i<font->n_glyphs; ++i)
-		area += (font->glyphs[i].image.w+1)*(font->glyphs[i].image.h+1);
+	{
+		size_t a = area+(font->glyphs[i].image.w+1)*(font->glyphs[i].image.h+1);
+		if(a<area)
+		{
+			fprintf(stderr, "Overflow in counting total glyph area\n");
+			return -1;
+		}
+		area = a;
+	}
 
 	/* Find an image size that's no higher than wide, allowing for some
 	imperfections in the packing. */
@@ -533,7 +587,9 @@ void render_packed(Font *font)
 	glyphs.  Since glyphs are rectangular and the image is filled starting from
 	the top, it's enough to track the number of used pixels at the top of each
 	column. */
-	font->image.data = (char *)malloc(font->image.w*font->image.h);
+	font->image.data = (char *)alloc_image_data(font->image.w, font->image.h);
+	if(!font->image.data)
+		return -1;
 	memset(font->image.data, 255, font->image.w*font->image.h);
 	used_pixels = (unsigned *)malloc(font->image.w*sizeof(unsigned));
 	memset(used_pixels, 0, font->image.w*sizeof(unsigned));
@@ -622,6 +678,11 @@ void render_packed(Font *font)
 	/* Trim the image to the actually used size, in case the original estimate
 	was too pessimistic. */
 	font->image.h = round_to_pot(used_h);
+
+	free(used_glyphs);
+	free(used_pixels);
+
+	return 0;
 }
 
 int save_defs(const char *fn, const Font *font)
@@ -699,7 +760,9 @@ int save_png(const char *fn, const Image *image, char alpha)
 	rows = (png_byte **)malloc(image->h*sizeof(png_byte *));
 	if(alpha)
 	{
-		data2 = (png_byte *)malloc(image->w*image->h*2);
+		data2 = (png_byte *)alloc_image_data(image->w*2, image->h);
+		if(!data2)
+			return -1;
 		for(i=0; i<image->w*image->h; ++i)
 		{
 			data2[i*2] = 255;
-- 
2.43.0