summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWerner Lemberg <wl@gnu.org>2014-11-15 09:05:22 +0100
committerWerner Lemberg <wl@gnu.org>2014-11-15 09:05:22 +0100
commit54abd22891bd51ef8b533b24df53b3019b5cee81 (patch)
treec862e9b419ee253bc5f1bd5f1ee9dafd81347457
parent257c270bd25e15890190a28a1456e7623bba4439 (diff)
downloadfreetype2-54abd22891bd51ef8b533b24df53b3019b5cee81.tar.gz
[sfnt] Fix Savannah bug #43597.
* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large bitmaps.
-rw-r--r--ChangeLog7
-rw-r--r--src/sfnt/pngshim.c7
2 files changed, 14 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index a6465e7..4cebb38 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-11-15 Werner Lemberg <wl@gnu.org>
+
+ [sfnt] Fix Savannah bug #43597.
+
+ * src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
+ bitmaps.
+
2014-11-12 Werner Lemberg <wl@gnu.org>
[sfnt] Fix Savannah bug #43591.
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 9afbe5a..fdb15d4 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -269,6 +269,13 @@
map->pitch = map->width * 4;
map->num_grays = 256;
+ /* reject too large bitmaps similarly to the rasterizer */
+ if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+ {
+ error = FT_THROW( Array_Too_Large );
+ goto DestroyExit;
+ }
+
size = map->rows * map->pitch;
error = ft_glyphslot_alloc_bitmap( slot, size );