diff options
| author | Werner Lemberg <wl@gnu.org> | 2014-11-15 09:05:22 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2014-11-15 09:05:22 +0100 |
| commit | 54abd22891bd51ef8b533b24df53b3019b5cee81 (patch) | |
| tree | c862e9b419ee253bc5f1bd5f1ee9dafd81347457 | |
| parent | 257c270bd25e15890190a28a1456e7623bba4439 (diff) | |
| download | freetype2-54abd22891bd51ef8b533b24df53b3019b5cee81.tar.gz | |
[sfnt] Fix Savannah bug #43597.
* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
bitmaps.
| -rw-r--r-- | ChangeLog | 7 | ||||
| -rw-r--r-- | src/sfnt/pngshim.c | 7 |
2 files changed, 14 insertions, 0 deletions
@@ -1,3 +1,10 @@ +2014-11-15 Werner Lemberg <wl@gnu.org> + + [sfnt] Fix Savannah bug #43597. + + * src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large + bitmaps. + 2014-11-12 Werner Lemberg <wl@gnu.org> [sfnt] Fix Savannah bug #43591. diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c index 9afbe5a..fdb15d4 100644 --- a/src/sfnt/pngshim.c +++ b/src/sfnt/pngshim.c @@ -269,6 +269,13 @@ map->pitch = map->width * 4; map->num_grays = 256; + /* reject too large bitmaps similarly to the rasterizer */ + if ( map->rows > 0x7FFF || map->width > 0x7FFF ) + { + error = FT_THROW( Array_Too_Large ); + goto DestroyExit; + } + size = map->rows * map->pitch; error = ft_glyphslot_alloc_bitmap( slot, size ); |
