]> git.lizzy.rs Git - plan9front.git/blob - sys/src/libdraw/font.c
libdraw: fix out of bounds memory access after subfont array reallocation (thanks...
[plan9front.git] / sys / src / libdraw / font.c
1 #include <u.h>
2 #include <libc.h>
3 #include <draw.h>
4
5 static int      fontresize(Font*, int, int, int);
6
7 #define PJW     0       /* use NUL==pjw for invisible characters */
8
9 /* return number of translated cache indices, 0 must retry, -1 on error */
10 int
11 cachechars(Font *f, char **ss, Rune **rr, ushort *cp, int max, int *wp, char **subfontname)
12 {
13         int i, j, th, sh, h, w, rw, wid, nc;
14         char *sp;
15         Rune r, *rp, vr;
16         ulong a;
17         Cacheinfo *c, *tc, *ec;
18
19         if(ss){
20                 sp = *ss;
21                 rp = L"";
22         }else{
23                 sp = "";
24                 rp = *rr;
25         }
26         wid = 0;
27         *subfontname = nil;
28         for(i=0; i<max && (*sp || *rp); sp+=w, rp+=rw){
29                 if(ss){
30                         r = *(uchar*)sp;
31                         if(r < Runeself)
32                                 w = 1;
33                         else{
34                                 w = chartorune(&vr, sp);
35                                 r = vr;
36                         }
37                         rw = 0;
38                 }else{
39                         r = *rp;
40                         w = 0;
41                         rw = 1;
42                 }
43
44                 sh = (17 * (uint)r) & (f->ncache-NFLOOK-1);
45                 c = &f->cache[sh];
46                 ec = c+NFLOOK;
47                 h = sh;
48                 while(c < ec){
49                         if(c->value==r && c->age)
50                                 goto Found;
51                         c++;
52                         h++;
53                 }
54         
55                 /*
56                  * Not found; toss out oldest entry
57                  */
58                 a = ~0;
59                 th = sh;
60                 tc = &f->cache[th];
61                 while(tc < ec){
62                         if(tc->age < a){
63                                 a = tc->age;
64                                 h = th;
65                                 c = tc;
66                         }
67                         tc++;
68                         th++;
69                 }
70
71                 if(a && (f->age-a)<500){        /* kicking out too recent; resize */
72                         nc = 2*(f->ncache-NFLOOK) + NFLOOK;
73                         if(nc <= MAXFCACHE){
74                                 if(i == 0)
75                                         fontresize(f, f->width, nc, f->maxdepth);
76                                 /* else flush first; retry will resize */
77                                 break;
78                         }
79                 }
80
81                 if(i > 0 && c->age == f->age)   /* flush pending string output */
82                         break;
83
84                 j = loadchar(f, r, c, h, i, subfontname);
85                 if(j <= 0){
86                         if(j < 0 || i > 0)      /* flush output or retry */ 
87                                 break;
88                         return -1;              /* stop retrying */
89                 }
90
91             Found:
92                 wid += c->width;
93                 c->age = f->age;
94                 cp[i] = h;
95                 i++;
96         }
97         if(ss)
98                 *ss = sp;
99         else
100                 *rr = rp;
101         *wp = wid;
102         return i;
103 }
104
105 void
106 agefont(Font *f)
107 {
108         Cacheinfo *c, *ec;
109         Cachesubf *s, *es;
110
111         f->age++;
112         if(f->age == 65536){
113                 /*
114                  * Renormalize ages
115                  */
116                 c = f->cache;
117                 ec = c+f->ncache;
118                 while(c < ec){
119                         if(c->age){
120                                 c->age >>= 2;
121                                 c->age++;
122                         }
123                         c++;
124                 }
125                 s = f->subf;
126                 es = s+f->nsubf;
127                 while(s < es){
128                         if(s->age){
129                                 if(s->age<SUBFAGE && s->cf->name != nil){
130                                         /* clean up */
131                                         if(f->display == nil || s->f != f->display->defaultsubfont)
132                                                 freesubfont(s->f);
133                                         s->cf = nil;
134                                         s->f = nil;
135                                         s->age = 0;
136                                 }else{
137                                         s->age >>= 2;
138                                         s->age++;
139                                 }
140                         }
141                         s++;
142                 }
143                 f->age = (65536>>2) + 1;
144         }
145 }
146
147 static Subfont*
148 cf2subfont(Cachefont *cf, Font *f)
149 {
150         int depth;
151         char *name;
152         Subfont *sf;
153
154         name = cf->subfontname;
155         if(name == nil){
156                 if(f->display != nil && f->display->screenimage != nil)
157                         depth = f->display->screenimage->depth;
158                 else
159                         depth = 8;
160                 name = subfontname(cf->name, f->name, depth);
161                 if(name == nil)
162                         return nil;
163                 cf->subfontname = name;
164         }
165         sf = lookupsubfont(f->display, name);
166         return sf;
167 }
168
169 /* return 1 if load succeeded, 0 if failed, -1 if must retry */
170 int
171 loadchar(Font *f, Rune r, Cacheinfo *c, int h, int noflush, char **subfontname)
172 {
173         int i, oi, wid, top, bottom;
174         Rune pic;
175         Fontchar *fi;
176         Cachefont *cf;
177         Cachesubf *subf, *of;
178         uchar *b;
179
180         pic = r;
181     Again:
182         for(i=0; i<f->nsub; i++){
183                 cf = f->sub[i];
184                 if(cf->min<=pic && pic<=cf->max)
185                         goto Found;
186         }
187     TryPJW:
188         if(pic != PJW){
189                 pic = PJW;
190                 goto Again;
191         }
192         return 0;
193
194     Found:
195         /*
196          * Choose exact or oldest
197          */
198         oi = 0;
199         subf = &f->subf[0];
200         for(i=0; i<f->nsubf; i++){
201                 if(cf == subf->cf)
202                         goto Found2;
203                 if(subf->age < f->subf[oi].age)
204                         oi = i;
205                 subf++;
206         }
207         subf = &f->subf[oi];
208
209         if(subf->f){
210                 if(f->age-subf->age>SUBFAGE || f->nsubf>MAXSUBF){
211     Toss:
212                         /* ancient data; toss */
213                         freesubfont(subf->f);
214                         subf->cf = nil;
215                         subf->f = nil;
216                         subf->age = 0;
217                 }else{                          /* too recent; grow instead */
218                         of = f->subf;
219                         f->subf = realloc(of, (f->nsubf+DSUBF)*sizeof *subf);
220                         if(f->subf == nil){
221                                 f->subf = of;
222                                 goto Toss;
223                         }
224                         subf = &f->subf[f->nsubf];
225                         memset(subf, 0, DSUBF*sizeof *subf);
226                         f->nsubf += DSUBF;
227                 }
228         }
229         subf->age = 0;
230         subf->cf = nil;
231         subf->f = cf2subfont(cf, f);
232         if(subf->f == nil){
233                 if(cf->subfontname == nil)
234                         goto TryPJW;
235                 *subfontname = cf->subfontname;
236                 return -1;
237         }
238
239         subf->cf = cf;
240         if(subf->f->ascent > f->ascent && f->display){
241                 /* should print something? this is a mistake in the font file */
242                 /* must prevent c->top from going negative when loading cache */
243                 Image *b;
244                 int d, t;
245                 d = subf->f->ascent - f->ascent;
246                 b = subf->f->bits;
247                 draw(b, b->r, b, nil, addpt(b->r.min, Pt(0, d)));
248                 draw(b, Rect(b->r.min.x, b->r.max.y-d, b->r.max.x, b->r.max.y), f->display->black, nil, b->r.min);
249                 for(i=0; i<subf->f->n; i++){
250                         t = subf->f->info[i].top-d;
251                         if(t < 0)
252                                 t = 0;
253                         subf->f->info[i].top = t;
254                         t = subf->f->info[i].bottom-d;
255                         if(t < 0)
256                                 t = 0;
257                         subf->f->info[i].bottom = t;
258                 }
259                 subf->f->ascent = f->ascent;
260         }
261
262     Found2:
263         subf->age = f->age;
264
265         /* possible overflow here, but works out okay */
266         pic += cf->offset;
267         pic -= cf->min;
268         if(pic >= subf->f->n)
269                 goto TryPJW;
270         fi = &subf->f->info[pic];
271         if(fi->width == 0)
272                 goto TryPJW;
273         wid = (fi+1)->x - fi->x;
274         if(f->width < wid || f->width == 0 || f->maxdepth < subf->f->bits->depth
275         || (f->display != nil && f->cacheimage == nil)){
276                 /*
277                  * Flush, free, reload (easier than reformatting f->b)
278                  */
279                 if(noflush)
280                         return -1;
281                 if(f->width < wid)
282                         f->width = wid;
283                 if(f->maxdepth < subf->f->bits->depth)
284                         f->maxdepth = subf->f->bits->depth;
285                 if(fontresize(f, f->width, f->ncache, f->maxdepth) <= 0)
286                         return -1;
287                 /* c is still valid as didn't reallocate f->cache */
288         }
289         c->value = r;
290         top = fi->top + (f->ascent-subf->f->ascent);
291         bottom = fi->bottom + (f->ascent-subf->f->ascent);
292         c->width = fi->width;
293         c->x = h*f->width;
294         c->left = fi->left;
295         if(f->display == nil)
296                 return 1;
297         b = bufimage(f->display, 37);
298         if(b == nil)
299                 return 0;
300         b[0] = 'l';
301         BPLONG(b+1, f->cacheimage->id);
302         BPLONG(b+5, subf->f->bits->id);
303         BPSHORT(b+9, c-f->cache);
304         BPLONG(b+11, c->x);
305         BPLONG(b+15, top);
306         BPLONG(b+19, c->x+((fi+1)->x-fi->x));
307         BPLONG(b+23, bottom);
308         BPLONG(b+27, fi->x);
309         BPLONG(b+31, fi->top);
310         b[35] = fi->left;
311         b[36] = fi->width;
312         return 1;
313 }
314
315 /* returns whether resize succeeded && f->cache is unchanged */
316 static int
317 fontresize(Font *f, int wid, int ncache, int depth)
318 {
319         Cacheinfo *i;
320         int ret;
321         Image *new;
322         uchar *b;
323         Display *d;
324
325         ret = 0;
326         if(depth <= 0)
327                 depth = 1;
328         if(wid <= 0)
329                 wid = 1;
330
331         d = f->display;
332         if(d == nil)
333                 goto Nodisplay;
334
335         new = allocimage(d, Rect(0, 0, ncache*wid, f->height), CHAN1(CGrey, depth), 0, 0);
336         if(new == nil){
337                 fprint(2, "font cache resize failed: %r\n");
338                 goto Return;
339         }
340         b = bufimage(d, 1+4+4+1);
341         if(b == nil){
342                 freeimage(new);
343                 goto Return;
344         }
345         b[0] = 'i';
346         BPLONG(b+1, new->id);
347         BPLONG(b+5, ncache);
348         b[9] = f->ascent;
349         freeimage(f->cacheimage);
350         f->cacheimage = new;
351     Nodisplay:
352         f->width = wid;
353         f->maxdepth = depth;
354         ret = 1;
355         if(f->ncache != ncache){
356                 i = malloc(ncache*sizeof f->cache[0]);
357                 if(i != nil){
358                         ret = 0;
359                         free(f->cache);
360                         f->ncache = ncache;
361                         f->cache = i;
362                 }
363                 /* else just wipe the cache clean and things will be ok */
364         }
365     Return:
366         memset(f->cache, 0, f->ncache*sizeof f->cache[0]);
367         return ret;
368 }