Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8289697

buffer overflow in MTLVertexCache.m: MTLVertexCache_AddGlyphQuad

XMLWordPrintable

    • 2d
    • b06
    • os_x

        Found this with asan, MTLVertexCache_AddGlyphQuad adds 6 vertexes to the buffer while checking space only for one vertex:
            if (vertexCacheIndex >= MTLVC_MAX_INDEX)
        ...
            MTLVC_ADD_TRIANGLES(tx1, ty1, tx2, ty2,
                                dx1, dy1, dx2, dy2);

        where
        #define MTLVC_ADD_TRIANGLES(TX1, TY1, TX2, TY2, DX1, DY1, DX2, DY2) \
            do { \
                MTLVC_ADD_VERTEX(TX1, TY1, DX1, DY1, 0); \
                MTLVC_ADD_VERTEX(TX2, TY1, DX2, DY1, 0); \
                MTLVC_ADD_VERTEX(TX2, TY2, DX2, DY2, 0); \
                MTLVC_ADD_VERTEX(TX2, TY2, DX2, DY2, 0); \
                MTLVC_ADD_VERTEX(TX1, TY2, DX1, DY2, 0); \
                MTLVC_ADD_VERTEX(TX1, TY1, DX1, DY1, 0); \
            } while (0)

        where

        #define MTLVC_ADD_VERTEX(TX, TY, DX, DY, DZ) \
            do { \
                J2DVertex *v = &vertexCache[vertexCacheIndex++]; \
                v->txtpos[0] = TX; \
                v->txtpos[1] = TY; \
                v->position[0]= DX; \
                v->position[1] = DY; \
            } while (0)

              vkempik Vladimir Kempik
              vkempik Vladimir Kempik
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: