Segfault scanning non-font files. Disallow scan edit of user vars. (#8767)

Missing NULL font check before attempting to edit scanned pattern.
Also, <match target="scan"> rules are now checked to ensure all
edited variables are in the predefined set; otherwise, the resulting
cache files will not be stable.

diff --git a/src/fcdir.c b/src/fcdir.c
index d08299269f0f85bcf937c2d224cab9f4c91c3f3e..e9e9d197c57a444801680afe5ce1c93213fe8707 100644 (file)
--- a/src/fcdir.c
+++ b/src/fcdir.c
@@ -65,7 +65,7 @@ FcFileScanFontConfig (FcFontSet               *set,
        /*
         * Edit pattern with user-defined rules
         */
-       if (config && !FcConfigSubstituteWithPat (config, font, NULL, FcMatchScan))
+       if (font && config && !FcConfigSubstituteWithPat (config, font, NULL, FcMatchScan))
        {
            FcPatternDestroy (font);
            font = NULL;

diff --git a/src/fcint.h b/src/fcint.h
index 60563cb56a046e3be37f85d1b0984a0d4c02fbb5..4ab4a74906a77fb6087ce73ee56af314018c17d4 100644 (file)
--- a/src/fcint.h
+++ b/src/fcint.h
@@ -865,6 +865,7 @@ FcListPatternMatchAny (const FcPattern *p,
 #define FC_EMBOLDEN_OBJECT     38
 #define FC_EMBEDDED_BITMAP_OBJECT      39
 #define FC_DECORATIVE_OBJECT   40
+#define FC_MAX_BASE_OBJECT     FC_DECORATIVE_OBJECT
 
 FcPrivate FcBool
 FcNameBool (const FcChar8 *v, FcBool *result);

diff --git a/src/fcxml.c b/src/fcxml.c
index a9453ebc0b01b31187320bcd5b08057836affe86..156599ca2fd5d8b5a94763664febc32920d7a826 100644 (file)
--- a/src/fcxml.c
+++ b/src/fcxml.c
@@ -1845,6 +1845,12 @@ FcParseMatch (FcConfigParse *parse)
            vstack->u.edit->next = edit;
            edit = vstack->u.edit;
            vstack->tag = FcVStackNone;
+           if (kind == FcMatchScan && edit->object > FC_MAX_BASE_OBJECT)
+           {
+               FcConfigMessage (parse, FcSevereError, 
+                                "<match target=\"scan\"> cannot edit user-defined object \"%s\"",
+                                FcObjectName(edit->object));
+           }
            break;
        default:
            FcConfigMessage (parse, FcSevereWarning, "invalid match element");