From 54abd22891bd51ef8b533b24df53b3019b5cee81 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Sat, 15 Nov 2014 09:05:22 +0100
Subject: [PATCH] [sfnt] Fix Savannah bug #43597.

* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
bitmaps.
---
 ChangeLog          | 7 +++++++
 src/sfnt/pngshim.c | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index a6465e746..4cebb38bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2014-11-15  Werner Lemberg  <wl@gnu.org>
+
+	[sfnt] Fix Savannah bug #43597.
+
+	* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
+	bitmaps.
+
 2014-11-12  Werner Lemberg  <wl@gnu.org>
 
 	[sfnt] Fix Savannah bug #43591.
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 9afbe5a58..fdb15d4ed 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -269,6 +269,13 @@
       map->pitch      = map->width * 4;
       map->num_grays  = 256;
 
+      /* reject too large bitmaps similarly to the rasterizer */
+      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto DestroyExit;
+      }
+
       size = map->rows * map->pitch;
 
       error = ft_glyphslot_alloc_bitmap( slot, size );