1 /* 2 * Copyright © 2007,2008,2009,2010 Red Hat, Inc. 3 * Copyright © 2012,2018 Google, Inc. 4 * 5 * This is part of HarfBuzz, a text shaping library. 6 * 7 * Permission is hereby granted, without written agreement and without 8 * license or royalty fees, to use, copy, modify, and distribute this 9 * software and its documentation for any purpose, provided that the 10 * above copyright notice and the following two paragraphs appear in 11 * all copies of this software. 12 * 13 * IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR 14 * DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES 15 * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN 16 * IF THE COPYRIGHT HOLDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH 17 * DAMAGE. 18 * 19 * THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, 20 * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND 21 * FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS 22 * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO 23 * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. 24 * 25 * Red Hat Author(s): Behdad Esfahbod 26 * Google Author(s): Behdad Esfahbod 27 */ 28 29 #ifndef HB_SANITIZE_HH 30 #define HB_SANITIZE_HH 31 32 #include "hb.hh" 33 #include "hb-blob.hh" 34 #include "hb-dispatch.hh" 35 36 37 /* 38 * Sanitize 39 * 40 * 41 * === Introduction === 42 * 43 * The sanitize machinery is at the core of our zero-cost font loading. We 44 * mmap() font file into memory and create a blob out of it. Font subtables 45 * are returned as a readonly sub-blob of the main font blob. These table 46 * blobs are then sanitized before use, to ensure invalid memory access does 47 * not happen. The toplevel sanitize API use is like, eg. to load the 'head' 48 * table: 49 * 50 * hb_blob_t *head_blob = hb_sanitize_context_t ().reference_table<OT::head> (face); 51 * 52 * The blob then can be converted to a head table struct with: 53 * 54 * const head *head_table = head_blob->as<head> (); 55 * 56 * What the reference_table does is, to call hb_face_reference_table() to load 57 * the table blob, sanitize it and return either the sanitized blob, or empty 58 * blob if sanitization failed. The blob->as() function returns the null 59 * object of its template type argument if the blob is empty. Otherwise, it 60 * just casts the blob contents to the desired type. 61 * 62 * Sanitizing a blob of data with a type T works as follows (with minor 63 * simplification): 64 * 65 * - Cast blob content to T*, call sanitize() method of it, 66 * - If sanitize succeeded, return blob. 67 * - Otherwise, if blob is not writable, try making it writable, 68 * or copy if cannot be made writable in-place, 69 * - Call sanitize() again. Return blob if sanitize succeeded. 70 * - Return empty blob otherwise. 71 * 72 * 73 * === The sanitize() contract === 74 * 75 * The sanitize() method of each object type shall return true if it's safe to 76 * call other methods of the object, and %false otherwise. 77 * 78 * Note that what sanitize() checks for might align with what the specification 79 * describes as valid table data, but does not have to be. In particular, we 80 * do NOT want to be pedantic and concern ourselves with validity checks that 81 * are irrelevant to our use of the table. On the contrary, we want to be 82 * lenient with error handling and accept invalid data to the extent that it 83 * does not impose extra burden on us. 84 * 85 * Based on the sanitize contract, one can see that what we check for depends 86 * on how we use the data in other table methods. Ie. if other table methods 87 * assume that offsets do NOT point out of the table data block, then that's 88 * something sanitize() must check for (GSUB/GPOS/GDEF/etc work this way). On 89 * the other hand, if other methods do such checks themselves, then sanitize() 90 * does not have to bother with them (glyf/local work this way). The choice 91 * depends on the table structure and sanitize() performance. For example, to 92 * check glyf/loca offsets in sanitize() would cost O(num-glyphs). We try hard 93 * to avoid such costs during font loading. By postponing such checks to the 94 * actual glyph loading, we reduce the sanitize cost to O(1) and total runtime 95 * cost to O(used-glyphs). As such, this is preferred. 96 * 97 * The same argument can be made re GSUB/GPOS/GDEF, but there, the table 98 * structure is so complicated that by checking all offsets at sanitize() time, 99 * we make the code much simpler in other methods, as offsets and referenced 100 * objects do not need to be validated at each use site. 101 */ 102 103 /* This limits sanitizing time on really broken fonts. */ 104 #ifndef HB_SANITIZE_MAX_EDITS 105 #define HB_SANITIZE_MAX_EDITS 32 106 #endif 107 #ifndef HB_SANITIZE_MAX_OPS_FACTOR 108 #define HB_SANITIZE_MAX_OPS_FACTOR 64 109 #endif 110 #ifndef HB_SANITIZE_MAX_OPS_MIN 111 #define HB_SANITIZE_MAX_OPS_MIN 16384 112 #endif 113 #ifndef HB_SANITIZE_MAX_OPS_MAX 114 #define HB_SANITIZE_MAX_OPS_MAX 0x3FFFFFFF 115 #endif 116 #ifndef HB_SANITIZE_MAX_SUBTABLES 117 #define HB_SANITIZE_MAX_SUBTABLES 0x4000 118 #endif 119 120 struct hb_sanitize_context_t : 121 hb_dispatch_context_t<hb_sanitize_context_t, bool, HB_DEBUG_SANITIZE> 122 { hb_sanitize_context_thb_sanitize_context_t123 hb_sanitize_context_t () : 124 start (nullptr), end (nullptr), 125 length (0), 126 max_ops (0), max_subtables (0), 127 recursion_depth (0), 128 writable (false), edit_count (0), 129 blob (nullptr), 130 num_glyphs (65536), 131 num_glyphs_set (false), 132 lazy_some_gpos (false) {} 133 get_namehb_sanitize_context_t134 const char *get_name () { return "SANITIZE"; } 135 template <typename T, typename F> may_dispatchhb_sanitize_context_t136 bool may_dispatch (const T *obj HB_UNUSED, const F *format) 137 { 138 return format->sanitize (this) && 139 hb_barrier (); 140 } default_return_valuehb_sanitize_context_t141 static return_t default_return_value () { return true; } no_dispatch_return_valuehb_sanitize_context_t142 static return_t no_dispatch_return_value () { return false; } stop_sublookup_iterationhb_sanitize_context_t143 bool stop_sublookup_iteration (const return_t r) const { return !r; } 144 visit_subtableshb_sanitize_context_t145 bool visit_subtables (unsigned count) 146 { 147 max_subtables += count; 148 return max_subtables < HB_SANITIZE_MAX_SUBTABLES; 149 } 150 151 private: 152 template <typename T, typename ...Ts> auto 153 _dispatch (const T &obj, hb_priority<1>, Ts&&... ds) HB_AUTO_RETURN 154 ( obj.sanitize (this, std::forward<Ts> (ds)...) ) 155 template <typename T, typename ...Ts> auto 156 _dispatch (const T &obj, hb_priority<0>, Ts&&... ds) HB_AUTO_RETURN 157 ( obj.dispatch (this, std::forward<Ts> (ds)...) ) 158 public: 159 template <typename T, typename ...Ts> auto dispatchhb_sanitize_context_t160 dispatch (const T &obj, Ts&&... ds) HB_AUTO_RETURN 161 ( _dispatch (obj, hb_prioritize, std::forward<Ts> (ds)...) ) 162 163 hb_sanitize_context_t (hb_blob_t *b) : hb_sanitize_context_t () 164 { 165 init (b); 166 167 if (blob) 168 start_processing (); 169 } 170 ~hb_sanitize_context_thb_sanitize_context_t171 ~hb_sanitize_context_t () 172 { 173 if (blob) 174 end_processing (); 175 } 176 inithb_sanitize_context_t177 void init (hb_blob_t *b) 178 { 179 this->blob = hb_blob_reference (b); 180 this->writable = false; 181 } 182 set_num_glyphshb_sanitize_context_t183 void set_num_glyphs (unsigned int num_glyphs_) 184 { 185 num_glyphs = num_glyphs_; 186 num_glyphs_set = true; 187 } get_num_glyphshb_sanitize_context_t188 unsigned int get_num_glyphs () { return num_glyphs; } 189 set_max_opshb_sanitize_context_t190 void set_max_ops (int max_ops_) { max_ops = max_ops_; } 191 192 template <typename T> set_objecthb_sanitize_context_t193 void set_object (const T *obj) 194 { 195 reset_object (); 196 197 if (!obj) return; 198 199 const char *obj_start = (const char *) obj; 200 if (unlikely (obj_start < this->start || this->end <= obj_start)) 201 { 202 this->start = this->end = nullptr; 203 this->length = 0; 204 } 205 else 206 { 207 this->start = obj_start; 208 this->end = obj_start + hb_min (size_t (this->end - obj_start), obj->get_size ()); 209 this->length = this->end - this->start; 210 } 211 } 212 reset_objecthb_sanitize_context_t213 void reset_object () 214 { 215 this->start = this->blob->data; 216 this->end = this->start + this->blob->length; 217 this->length = this->end - this->start; 218 assert (this->start <= this->end); /* Must not overflow. */ 219 } 220 start_processinghb_sanitize_context_t221 void start_processing () 222 { 223 reset_object (); 224 unsigned m; 225 if (unlikely (hb_unsigned_mul_overflows (this->end - this->start, HB_SANITIZE_MAX_OPS_FACTOR, &m))) 226 this->max_ops = HB_SANITIZE_MAX_OPS_MAX; 227 else 228 this->max_ops = hb_clamp (m, 229 (unsigned) HB_SANITIZE_MAX_OPS_MIN, 230 (unsigned) HB_SANITIZE_MAX_OPS_MAX); 231 this->edit_count = 0; 232 this->debug_depth = 0; 233 this->recursion_depth = 0; 234 235 DEBUG_MSG_LEVEL (SANITIZE, start, 0, +1, 236 "start [%p..%p] (%lu bytes)", 237 this->start, this->end, 238 (unsigned long) (this->end - this->start)); 239 } 240 end_processinghb_sanitize_context_t241 void end_processing () 242 { 243 DEBUG_MSG_LEVEL (SANITIZE, this->start, 0, -1, 244 "end [%p..%p] %u edit requests", 245 this->start, this->end, this->edit_count); 246 247 hb_blob_destroy (this->blob); 248 this->blob = nullptr; 249 this->start = this->end = nullptr; 250 this->length = 0; 251 } 252 get_edit_counthb_sanitize_context_t253 unsigned get_edit_count () { return edit_count; } 254 255 check_opshb_sanitize_context_t256 bool check_ops(unsigned count) 257 { 258 /* Avoid underflow */ 259 if (unlikely (this->max_ops < 0 || count >= (unsigned) this->max_ops)) 260 { 261 this->max_ops = -1; 262 return false; 263 } 264 this->max_ops -= (int) count; 265 return true; 266 } 267 268 #ifndef HB_OPTIMIZE_SIZE 269 HB_ALWAYS_INLINE 270 #endif check_rangehb_sanitize_context_t271 bool check_range (const void *base, 272 unsigned int len) const 273 { 274 const char *p = (const char *) base; 275 bool ok = (uintptr_t) (p - this->start) <= this->length && 276 (unsigned int) (this->end - p) >= len && 277 ((this->max_ops -= len) > 0); 278 279 DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, 280 "check_range [%p..%p]" 281 " (%u bytes) in [%p..%p] -> %s", 282 p, p + len, len, 283 this->start, this->end, 284 ok ? "OK" : "OUT-OF-RANGE"); 285 286 return likely (ok); 287 } 288 #ifndef HB_OPTIMIZE_SIZE 289 HB_ALWAYS_INLINE 290 #endif check_range_fasthb_sanitize_context_t291 bool check_range_fast (const void *base, 292 unsigned int len) const 293 { 294 const char *p = (const char *) base; 295 bool ok = ((uintptr_t) (p - this->start) <= this->length && 296 (unsigned int) (this->end - p) >= len); 297 298 DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, 299 "check_range_fast [%p..%p]" 300 " (%u bytes) in [%p..%p] -> %s", 301 p, p + len, len, 302 this->start, this->end, 303 ok ? "OK" : "OUT-OF-RANGE"); 304 305 return likely (ok); 306 } 307 308 #ifndef HB_OPTIMIZE_SIZE 309 HB_ALWAYS_INLINE 310 #endif check_pointhb_sanitize_context_t311 bool check_point (const void *base) const 312 { 313 const char *p = (const char *) base; 314 bool ok = (uintptr_t) (p - this->start) <= this->length; 315 316 DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, 317 "check_point [%p]" 318 " in [%p..%p] -> %s", 319 p, 320 this->start, this->end, 321 ok ? "OK" : "OUT-OF-RANGE"); 322 323 return likely (ok); 324 } 325 326 template <typename T> check_rangehb_sanitize_context_t327 bool check_range (const T *base, 328 unsigned int a, 329 unsigned int b) const 330 { 331 unsigned m; 332 return !hb_unsigned_mul_overflows (a, b, &m) && 333 this->check_range (base, m); 334 } 335 336 template <typename T> check_rangehb_sanitize_context_t337 bool check_range (const T *base, 338 unsigned int a, 339 unsigned int b, 340 unsigned int c) const 341 { 342 unsigned m; 343 return !hb_unsigned_mul_overflows (a, b, &m) && 344 this->check_range (base, m, c); 345 } 346 347 template <typename T> 348 HB_ALWAYS_INLINE check_array_sizedhb_sanitize_context_t349 bool check_array_sized (const T *base, unsigned int len, unsigned len_size) const 350 { 351 if (len_size >= 4) 352 { 353 if (unlikely (hb_unsigned_mul_overflows (len, hb_static_size (T), &len))) 354 return false; 355 } 356 else 357 len = len * hb_static_size (T); 358 return this->check_range (base, len); 359 } 360 361 template <typename T> check_arrayhb_sanitize_context_t362 bool check_array (const T *base, unsigned int len) const 363 { 364 return this->check_range (base, len, hb_static_size (T)); 365 } 366 367 template <typename T> check_arrayhb_sanitize_context_t368 bool check_array (const T *base, 369 unsigned int a, 370 unsigned int b) const 371 { 372 return this->check_range (base, hb_static_size (T), a, b); 373 } 374 check_start_recursionhb_sanitize_context_t375 bool check_start_recursion (int max_depth) 376 { 377 if (unlikely (recursion_depth >= max_depth)) return false; 378 return ++recursion_depth; 379 } 380 end_recursionhb_sanitize_context_t381 bool end_recursion (bool result) 382 { 383 recursion_depth--; 384 return result; 385 } 386 387 template <typename Type> 388 #ifndef HB_OPTIMIZE_SIZE 389 HB_ALWAYS_INLINE 390 #endif check_structhb_sanitize_context_t391 bool check_struct (const Type *obj) const 392 { 393 if (sizeof (uintptr_t) == sizeof (uint32_t)) 394 return likely (this->check_range_fast (obj, obj->min_size)); 395 else 396 return likely (this->check_point ((const char *) obj + obj->min_size)); 397 } 398 may_edithb_sanitize_context_t399 bool may_edit (const void *base, unsigned int len) 400 { 401 if (this->edit_count >= HB_SANITIZE_MAX_EDITS) 402 return false; 403 404 const char *p = (const char *) base; 405 this->edit_count++; 406 407 DEBUG_MSG_LEVEL (SANITIZE, p, this->debug_depth+1, 0, 408 "may_edit(%u) [%p..%p] (%u bytes) in [%p..%p] -> %s", 409 this->edit_count, 410 p, p + len, len, 411 this->start, this->end, 412 this->writable ? "GRANTED" : "DENIED"); 413 414 return this->writable; 415 } 416 417 template <typename Type, typename ValueType> try_sethb_sanitize_context_t418 bool try_set (const Type *obj, const ValueType &v) 419 { 420 if (this->may_edit (obj, hb_static_size (Type))) 421 { 422 * const_cast<Type *> (obj) = v; 423 return true; 424 } 425 return false; 426 } 427 428 template <typename Type> sanitize_blobhb_sanitize_context_t429 hb_blob_t *sanitize_blob (hb_blob_t *blob) 430 { 431 bool sane; 432 433 init (blob); 434 435 retry: 436 DEBUG_MSG_FUNC (SANITIZE, start, "start"); 437 438 start_processing (); 439 440 if (unlikely (!start)) 441 { 442 end_processing (); 443 return blob; 444 } 445 446 Type *t = reinterpret_cast<Type *> (const_cast<char *> (start)); 447 448 sane = t->sanitize (this); 449 if (sane) 450 { 451 if (edit_count) 452 { 453 DEBUG_MSG_FUNC (SANITIZE, start, "passed first round with %u edits; going for second round", edit_count); 454 455 /* sanitize again to ensure no toe-stepping */ 456 edit_count = 0; 457 sane = t->sanitize (this); 458 if (edit_count) { 459 DEBUG_MSG_FUNC (SANITIZE, start, "requested %u edits in second round; FAILING", edit_count); 460 sane = false; 461 } 462 } 463 } 464 else 465 { 466 if (edit_count && !writable) { 467 start = hb_blob_get_data_writable (blob, nullptr); 468 end = start + blob->length; 469 470 if (start) 471 { 472 writable = true; 473 /* ok, we made it writable by relocating. try again */ 474 DEBUG_MSG_FUNC (SANITIZE, start, "retry"); 475 goto retry; 476 } 477 } 478 } 479 480 end_processing (); 481 482 DEBUG_MSG_FUNC (SANITIZE, start, sane ? "PASSED" : "FAILED"); 483 if (sane) 484 { 485 hb_blob_make_immutable (blob); 486 return blob; 487 } 488 else 489 { 490 hb_blob_destroy (blob); 491 return hb_blob_get_empty (); 492 } 493 } 494 495 template <typename Type> reference_tablehb_sanitize_context_t496 hb_blob_t *reference_table (const hb_face_t *face, hb_tag_t tableTag = Type::tableTag) 497 { 498 if (!num_glyphs_set) 499 set_num_glyphs (hb_face_get_glyph_count (face)); 500 return sanitize_blob<Type> (hb_face_reference_table (face, tableTag)); 501 } 502 503 const char *start, *end; 504 unsigned length; 505 mutable int max_ops, max_subtables; 506 private: 507 int recursion_depth; 508 bool writable; 509 unsigned int edit_count; 510 hb_blob_t *blob; 511 unsigned int num_glyphs; 512 bool num_glyphs_set; 513 public: 514 bool lazy_some_gpos; 515 }; 516 517 struct hb_sanitize_with_object_t 518 { 519 template <typename T> hb_sanitize_with_object_thb_sanitize_with_object_t520 hb_sanitize_with_object_t (hb_sanitize_context_t *c, const T& obj) : c (c) 521 { c->set_object (obj); } ~hb_sanitize_with_object_thb_sanitize_with_object_t522 ~hb_sanitize_with_object_t () 523 { c->reset_object (); } 524 525 private: 526 hb_sanitize_context_t *c; 527 }; 528 529 530 #endif /* HB_SANITIZE_HH */ 531