minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

Prevent too negative values (< FT_INT_MIN) in bitmap metrics, 

suggested by Alexei.

* src/pfr/pfrsbit.c (pfr_slot_load_bitmap): Prevent too
negative values in `xpos' and `ypos + ysize'.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Prevent
too negative values in `x_left' and `y_top'.  Either negative
values in `width' and `height' are checked.
This commit is contained in:
suzuki toshiya 2014-11-27 17:53:20 +09:00
parent c52882ab72
commit 1b057040d8
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2014-11-27 suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp>
Prevent too negative values (< FT_INT_MIN) in bitmap metrics,
suggested by Alexei.
* src/pfr/pfrsbit.c (pfr_slot_load_bitmap): Prevent too
negative values in `xpos' and `ypos + ysize'.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Prevent
too negative values in `x_left' and `y_top'. Either negative
values in `width' and `height' are checked.
2014-11-27 Werner Lemberg <wl@gnu.org>
[docmaker] Produce better HTML code.

3
src/pfr/pfrsbit.c
View File

@ -636,7 +636,8 @@
* which causes a size truncation, because truncated
* size properties makes bitmap glyph broken.
*/
if ( xpos > FT_INT_MAX || ( ypos + ysize ) > FT_INT_MAX )
if ( xpos > FT_INT_MAX || ( ypos + ysize ) > FT_INT_MAX ||
xpos < FT_INT_MIN || ( ypos + ysize ) < FT_INT_MIN )
{
FT_TRACE1(( "pfr_slot_load_bitmap:" ));
FT_TRACE1(( "huge bitmap glyph %dx%d over FT_GlyphSlot\n",

6
src/smooth/ftsmooth.c
View File

@ -205,7 +205,8 @@
* XXX: on 16bit system, we return an error for huge bitmap
* to prevent an overflow.
*/
if ( x_left > FT_INT_MAX || y_top > FT_INT_MAX )
if ( x_left > FT_INT_MAX || y_top > FT_INT_MAX ||
x_left < FT_INT_MIN || y_top < FT_INT_MIN )
{
error = FT_THROW( Invalid_Pixel_Size );
goto Exit;
@ -213,7 +214,8 @@
/* Required check is (pitch * height < FT_ULONG_MAX), */
/* but we care realistic cases only. Always pitch <= width. */
if ( width > 0x7FFF || height > 0x7FFF )
if ( width < 0 || width > 0x7FFF ||
height < 0 || height > 0x7FFF )
{
FT_ERROR(( "ft_smooth_render_generic: glyph too large: %u x %u\n",
width, height ));