Commit d2d7dcbe for tesseract
commit d2d7dcbe8eaed4889a3f4711a97c65d650aa4caa
Author: Stefan Weil <sw@weilnetz.de>
Date: Sun Jul 12 21:57:46 2026 +0200
Fix pre-existing issues found by Copilot review
- fontinfo.cpp: defer assignment of fi->name until after DeSerialize
succeeds, and free the buffer on failure, preventing a leak.
- unicharcompress.h: add bounds check in RecodedCharID::Set to
prevent out-of-bounds write when index >= kMaxCodeLen.
- tessdatamanager.cpp: reject negative size in LoadMemBuffer before
passing it to TFile::Open, preventing wrap to a huge size_t.
Assisted-by: OpenCode / big-pickle (opencode)
Reported-by: GitHub Copilot
Signed-off-by: Stefan Weil <stweil@tessus.org>
diff --git a/src/ccstruct/fontinfo.cpp b/src/ccstruct/fontinfo.cpp
index 8448f6f1..444578ba 100644
--- a/src/ccstruct/fontinfo.cpp
+++ b/src/ccstruct/fontinfo.cpp
@@ -150,10 +150,11 @@ bool read_info(TFile *f, FontInfo *fi) {
return false;
}
char *font_name = new char[size + 1];
- fi->name = font_name;
if (!f->DeSerialize(font_name, size)) {
+ delete[] font_name;
return false;
}
+ fi->name = font_name;
font_name[size] = '\0';
return f->DeSerialize(&fi->properties);
}
diff --git a/src/ccutil/tessdatamanager.cpp b/src/ccutil/tessdatamanager.cpp
index debdf035..35b1d91f 100644
--- a/src/ccutil/tessdatamanager.cpp
+++ b/src/ccutil/tessdatamanager.cpp
@@ -109,6 +109,9 @@ bool TessdataManager::Init(const char *data_file_name) {
// Loads from the given memory buffer as if a file.
bool TessdataManager::LoadMemBuffer(const char *name, const char *data, int size) {
// TODO: This method supports only the proprietary file format.
+ if (size < 0) {
+ return false;
+ }
Clear();
data_file_name_ = name;
TFile fp;
diff --git a/src/ccutil/unicharcompress.h b/src/ccutil/unicharcompress.h
index f67ae2cf..e8aac12d 100644
--- a/src/ccutil/unicharcompress.h
+++ b/src/ccutil/unicharcompress.h
@@ -44,6 +44,9 @@ public:
}
// Sets the code value at the given index in the code.
void Set(uint32_t index, int value) {
+ if (index >= kMaxCodeLen) {
+ return;
+ }
code_[index] = value;
if (length_ <= index) {
length_ = index + 1;