* src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
This commit is contained in:
parent
4a1f1a6d2a
commit
0ad3262366
|
@ -1,3 +1,7 @@
|
|||
2017-06-01 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
* src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
|
||||
|
||||
2017-06-01 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
[psaux] 32bit integer overflow tun-time errors (#46149).
|
||||
|
|
|
@ -408,6 +408,19 @@
|
|||
goto Exit;
|
||||
|
||||
/* copy advance while converting 26.6 to 16.16 format */
|
||||
if ( slot->advance.x >= 0x8000L * 64 ||
|
||||
slot->advance.x <= -0x8000L * 64 )
|
||||
{
|
||||
FT_ERROR(( "FT_Get_Glyph: advance width too large\n" ));
|
||||
return FT_THROW( Invalid_Argument );
|
||||
}
|
||||
if ( slot->advance.y >= 0x8000L * 64 ||
|
||||
slot->advance.y <= -0x8000L * 64 )
|
||||
{
|
||||
FT_ERROR(( "FT_Get_Glyph: advance height too large\n" ));
|
||||
return FT_THROW( Invalid_Argument );
|
||||
}
|
||||
|
||||
glyph->advance.x = slot->advance.x * 1024;
|
||||
glyph->advance.y = slot->advance.y * 1024;
|
||||
|
||||
|
|
Loading…
Reference in New Issue