Segfault scanning non-font files. Disallow scan edit of user vars. (#8767)

[fontconfig.git] / src / fcxml.c

diff --git a/src/fcxml.c b/src/fcxml.c
index 608f834b94afe51cc2602f599d3e4f919caa6552..156599ca2fd5d8b5a94763664febc32920d7a826 100644 (file)
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -545,6 +545,8 @@ FcTypecheckValue (FcConfigParse *parse, FcType value, FcType type)
        if ((value == FcTypeLangSet && type == FcTypeString) ||
            (value == FcTypeString && type == FcTypeLangSet))
            return;
+       if (type == (FcType) -1)
+           return;
        FcConfigMessage (parse, FcSevereWarning, "saw %s, expected %s",
                         FcTypeName (value), FcTypeName (type));
     }
@@ -668,7 +670,7 @@ FcTestCreate (FcConfigParse *parse,
 
 static FcEdit *
 FcEditCreate (FcConfigParse    *parse,
-             const char        *field,
+             FcObject          object,
              FcOp              op,
              FcExpr            *expr,
              FcValueBinding    binding)
@@ -680,7 +682,7 @@ FcEditCreate (FcConfigParse *parse,
        const FcObjectType      *o;
 
        e->next = 0;
-       e->object = FcObjectFromName (field);
+       e->object = object;
        e->op = op;
        e->expr = expr;
        e->binding = binding;
@@ -1410,7 +1412,7 @@ FcParseAlias (FcConfigParse *parse)
     if (prefer)
     {
        edit = FcEditCreate (parse, 
-                            FcConfigSaveField ("family"),
+                            FC_FAMILY_OBJECT,
                             FcOpPrepend,
                             prefer,
                             FcValueBindingWeak);
@@ -1423,7 +1425,7 @@ FcParseAlias (FcConfigParse *parse)
     {
        next = edit;
        edit = FcEditCreate (parse,
-                            FcConfigSaveField ("family"),
+                            FC_FAMILY_OBJECT,
                             FcOpAppend,
                             accept,
                             FcValueBindingWeak);
@@ -1436,7 +1438,7 @@ FcParseAlias (FcConfigParse *parse)
     {
        next = edit;
        edit = FcEditCreate (parse,
-                            FcConfigSaveField ("family"),
+                            FC_FAMILY_OBJECT,
                             FcOpAppendLast,
                             def,
                             FcValueBindingWeak);
@@ -1667,6 +1669,8 @@ FcParseTest (FcConfigParse *parse)
            kind = FcMatchPattern;
        else if (!strcmp ((char *) kind_string, "font"))
            kind = FcMatchFont;
+       else if (!strcmp ((char *) kind_string, "scan"))
+           kind = FcMatchScan;
        else if (!strcmp ((char *) kind_string, "default"))
            kind = FcMatchDefault;
        else
@@ -1791,7 +1795,8 @@ FcParseEdit (FcConfigParse *parse)
        }
     }
     expr = FcPopBinary (parse, FcOpComma);
-    edit = FcEditCreate (parse, (char *) FcStrCopy (name), mode, expr, binding);
+    edit = FcEditCreate (parse, FcObjectFromName ((char *) name),
+                        mode, expr, binding);
     if (!edit)
     {
        FcConfigMessage (parse, FcSevereError, "out of memory");
@@ -1820,6 +1825,8 @@ FcParseMatch (FcConfigParse *parse)
            kind = FcMatchPattern;
        else if (!strcmp ((char *) kind_name, "font"))
            kind = FcMatchFont;
+       else if (!strcmp ((char *) kind_name, "scan"))
+           kind = FcMatchScan;
        else
        {
            FcConfigMessage (parse, FcSevereWarning, "invalid match target \"%s\"", kind_name);
@@ -1838,6 +1845,12 @@ FcParseMatch (FcConfigParse *parse)
            vstack->u.edit->next = edit;
            edit = vstack->u.edit;
            vstack->tag = FcVStackNone;
+           if (kind == FcMatchScan && edit->object > FC_MAX_BASE_OBJECT)
+           {
+               FcConfigMessage (parse, FcSevereError, 
+                                "<match target=\"scan\"> cannot edit user-defined object \"%s\"",
+                                FcObjectName(edit->object));
+           }
            break;
        default:
            FcConfigMessage (parse, FcSevereWarning, "invalid match element");
@@ -2074,11 +2087,7 @@ FcEndElement(void *userData, const XML_Char *name)
            FcConfigMessage (parse, FcSevereError, "out of memory");
            break;
        }
-       if (!FcStrUsesHome (data) || FcConfigHome ())
-       {
-           if (!FcConfigSetCache (parse->config, data))
-               FcConfigMessage (parse, FcSevereError, "out of memory");
-       }
+       /* discard this data; no longer used */
        FcStrFree (data);
        break;
     case FcElementInclude:
@@ -2278,6 +2287,14 @@ FcEndDoctypeDecl (void *userData)
 
 #endif /* ENABLE_LIBXML2 */
 
+static int
+FcSortCmpStr (const void *a, const void *b)
+{
+    const FcChar8    *as = *((FcChar8 **) a);
+    const FcChar8    *bs = *((FcChar8 **) b);
+    return FcStrCmp (as, bs);
+}
+
 static FcBool
 FcConfigParseAndLoadDir (FcConfig      *config,
                         const FcChar8  *name,
@@ -2347,7 +2364,7 @@ FcConfigParseAndLoadDir (FcConfig *config,
     {
        int i;
        qsort (files->strs, files->num, sizeof (FcChar8 *), 
-              (int (*)(const void *, const void *)) FcStrCmp);
+              (int (*)(const void *, const void *)) FcSortCmpStr);
        for (i = 0; ret && i < files->num; i++)
            ret = FcConfigParseAndLoad (config, files->strs[i], complain);
     }
@@ -2490,3 +2507,6 @@ bail0:
     }
     return FcTrue;
 }
+#define __fcxml__
+#include "fcaliastail.h"
+#undef __fcxml__