[ots] Fix (potential) use-after-free bugs

Make sure we don’t try to access the table after deleting it. Not all the changed files are affected, but I changed them all for the sake of consistency.
khaledhosny · Nov 15, 2014 · 003c62d · 003c62d
1 parent eaa05ed
commit 003c62d
Show file tree

Hide file tree

Showing 10 changed files with 15 additions and 15 deletions.
diff --git a/src/gasp.cc b/src/gasp.cc
@@ -11,10 +11,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->gasp; \
-    file->gasp = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->gasp; \
+    file->gasp = 0; \
   } while (0)
 
 namespace ots {

diff --git a/src/gdef.cc b/src/gdef.cc
@@ -231,9 +231,9 @@ bool ParseMarkGlyphSetsDefTable(ots::OpenTypeFile *file, const uint8_t *data,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gdef->data = 0; \
     file->gdef->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

diff --git a/src/gpos.cc b/src/gpos.cc
@@ -677,9 +677,9 @@ bool ParseExtensionPositioning(const ots::OpenTypeFile *file,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gpos->data = 0; \
     file->gpos->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

diff --git a/src/gsub.cc b/src/gsub.cc
@@ -530,9 +530,9 @@ bool ParseReverseChainingContextSingleSubstitution(
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->gsub->data = 0; \
     file->gsub->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

diff --git a/src/hdmx.cc b/src/hdmx.cc
@@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->hdmx; \
-    file->hdmx = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->hdmx; \
+    file->hdmx = 0; \
   } while (0)
 
 namespace ots {

diff --git a/src/kern.cc b/src/kern.cc
@@ -11,9 +11,9 @@
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     delete file->kern; \
     file->kern = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

diff --git a/src/ltsh.cc b/src/ltsh.cc
@@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->ltsh; \
-    file->ltsh = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->ltsh; \
+    file->ltsh = 0; \
   } while (0)
 
 namespace ots {

diff --git a/src/math.cc b/src/math.cc
@@ -518,9 +518,9 @@ bool ParseMathVariantsTable(const ots::OpenTypeFile *file,
 
 #define DROP_THIS_TABLE(msg_) \
   do { \
+    OTS_FAILURE_MSG(msg_ ", table discarded"); \
     file->math->data = 0; \
     file->math->length = 0; \
-    OTS_FAILURE_MSG(msg_ ", table discarded"); \
   } while (0)
 
 namespace ots {

diff --git a/src/vdmx.cc b/src/vdmx.cc
@@ -11,10 +11,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->vdmx; \
-    file->vdmx = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->vdmx; \
+    file->vdmx = 0; \
   } while (0)
 
 namespace ots {

diff --git a/src/vorg.cc b/src/vorg.cc
@@ -13,10 +13,10 @@
 
 #define DROP_THIS_TABLE(...) \
   do { \
-    delete file->vorg; \
-    file->vorg = 0; \
     OTS_FAILURE_MSG_(file, TABLE_NAME ": " __VA_ARGS__); \
     OTS_FAILURE_MSG("Table discarded"); \
+    delete file->vorg; \
+    file->vorg = 0; \
   } while (0)
 
 namespace ots {