Home | History | Annotate | Line # | Download | only in test 
      1 /*
      2  * ZDI-CAN-30559: PCF RepadBitmap heap buffer overflow
      3  *
      4  * The font declares a tiny bitmapSizes[2] (for pad=4, 16 bytes) but has
      5  * per-glyph metrics (200x20) that cause RepadBitmap to write 560 bytes.
      6  * Without the fix, this overflows the allocated buffer by 544 bytes.
      7  *
      8  * With the fix in pcfread.c, the library computes the required buffer
      9  * size from per-glyph metrics instead of trusting bitmapSizes[].
     10  *
     11  * Test font: test/data/repad/evil-repad.pcf
     12  * Generated by: test/gen_evil_pcf_repad.py
     13  */
     14 
     15 /*
     16  * Copyright (c) 2026, Red Hat, Inc.
     17  *
     18  * Permission is hereby granted, free of charge, to any person obtaining a
     19  * copy of this software and associated documentation files (the "Software"),
     20  * to deal in the Software without restriction, including without limitation
     21  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
     22  * and/or sell copies of the Software, and to permit persons to whom the
     23  * Software is furnished to do so, subject to the following conditions:
     24  *
     25  * The above copyright notice and this permission notice (including the next
     26  * paragraph) shall be included in all copies or substantial portions of the
     27  * Software.
     28  *
     29  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     30  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     31  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
     32  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     33  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
     34  * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
     35  * DEALINGS IN THE SOFTWARE.
     36  */
     37 
     38 #include "pcf-test-common.h"
     39 #include <stdio.h>
     40 #include <stdlib.h>
     41 
     42 int
     43 main(int argc, char **argv)
     44 {
     45     xfont2_fpe_funcs_rec const **fpe_functions;
     46     int fpe_function_count;
     47     const char *builddir;
     48     char fontdir[512];
     49 
     50     builddir = getenv("builddir");
     51     if (!builddir)
     52         builddir = ".";
     53 
     54     fpe_functions = pcf_test_init(&fpe_function_count);
     55 
     56     snprintf(fontdir, sizeof(fontdir), "%s/test/data/repad", builddir);
     57     return pcf_test_open_font(fpe_functions,
     58                               "ZDI-CAN-30559-repad",
     59                               fontdir,
     60                               "-evil-repad-medium-r-normal--10-100-75-75-c-80-iso10646-1");
     61 }
     62