Home | History | Annotate | Line # | Download | only in test 
      1 /*
      2  * ZDI-CAN-30560: computeProps property buffer heap overflow
      3  *
      4  * The font has 40 duplicate MIN_SPACE properties. When the bitmap
      5  * scaler processes this font, computeProps writes 2 slots per scaledX
      6  * match into the fixed 70-slot property buffer, overflowing after 25
      7  * matches (50 slots + 20 XLFD slots = 70, then overflow).
      8  *
      9  * With the fix in bitscale.c, computeProps checks remaining buffer
     10  * capacity and silently skips properties that would overflow.
     11  *
     12  * The font is stored at pixel=10; loading at pixel=20 triggers the
     13  * scaling path through ComputeScaledProperties -> computeProps.
     14  *
     15  * Test font: test/data/props/evil-props.pcf
     16  * Generated by: test/gen_evil_pcf_props.py
     17  */
     18 
     19 /*
     20  * Copyright (c) 2026, Red Hat, Inc.
     21  *
     22  * Permission is hereby granted, free of charge, to any person obtaining a
     23  * copy of this software and associated documentation files (the "Software"),
     24  * to deal in the Software without restriction, including without limitation
     25  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
     26  * and/or sell copies of the Software, and to permit persons to whom the
     27  * Software is furnished to do so, subject to the following conditions:
     28  *
     29  * The above copyright notice and this permission notice (including the next
     30  * paragraph) shall be included in all copies or substantial portions of the
     31  * Software.
     32  *
     33  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     34  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     35  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
     36  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     37  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
     38  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
     39  * DEALINGS IN THE SOFTWARE.
     40  */
     41 
     42 #include "pcf-test-common.h"
     43 #include <stdio.h>
     44 #include <stdlib.h>
     45 
     46 int
     47 main(int argc, char **argv)
     48 {
     49     xfont2_fpe_funcs_rec const **fpe_functions;
     50     int fpe_function_count;
     51     const char *builddir;
     52     char fontdir[512];
     53 
     54     builddir = getenv("builddir");
     55     if (!builddir)
     56         builddir = ".";
     57 
     58     fpe_functions = pcf_test_init(&fpe_function_count);
     59 
     60     snprintf(fontdir, sizeof(fontdir), "%s/test/data/props", builddir);
     61     return pcf_test_open_font(fpe_functions,
     62                               "ZDI-CAN-30560-props",
     63                               fontdir,
     64                               "-evil-props-medium-r-normal--20-200-75-75-c-80-iso10646-1");
     65 }
     66