minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

Protect against too large glyphs. 

Problem reported by Tavis Ormandy <taviso@google.com>.

* src/smooth/ftsmooth.c (ft_smooth_render_generic): Don't allow
`width' or `pitch' to be larger than 0xFFFF.
This commit is contained in:
Werner Lemberg 2009-03-20 08:21:37 +01:00
parent a18788b14d
commit 79972af4f0
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,12 @@
2009-03-20 Werner Lemberg <wl@gnu.org>
Protect against too large glyphs.
Problem reported by Tavis Ormandy <taviso@google.com>.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Don't allow
`width' or `pitch' to be larger than 0xFFFF.
2009-03-20 Werner Lemberg <wl@gnu.org>
Tavis Ormandy <taviso@google.com>
@ -11,8 +20,6 @@
Protect against malformed compressed data.
Problem reported by Tavis Ormandy <taviso@google.com>.
* src/lsw/ftzopen.c (ft_lzwstate_io): Test whether `state->prefix' is
zero.

9
src/smooth/ftsmooth.c
View File

@ -153,7 +153,7 @@
slot->internal->flags &= ~FT_GLYPH_OWN_BITMAP;
}
/* allocate new one, depends on pixel format */
/* allocate new one */
pitch = width;
if ( hmul )
{
@ -194,6 +194,13 @@
#endif
if ( pitch > 0xFFFF || height > 0xFFFF )
{
FT_ERROR(( "ft_smooth_render_generic: glyph too large: %d x %d\n",
width, height ));
return Smooth_Err_Raster_Overflow;
}
bitmap->pixel_mode = FT_PIXEL_MODE_GRAY;
bitmap->num_grays = 256;
bitmap->width = width;