rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Check parameters of `FT_Outline_New'. 

Problem reported by Robin Watts <robin.watts@artifex.com>.

* src/base/ftoutln.c (FT_Outline_New_Internal): Ensure that
`numContours' and `numPoints' fit into FT_Outline's `n_points' and
`n_contours', respectively.
This commit is contained in:
Werner Lemberg 2012-12-21 16:45:27 +01:00
parent c6a66b49e6
commit 3ffb822e92
3 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,12 @@
2012-12-21 Werner Lemberg <wl@gnu.org>
Check parameters of `FT_Outline_New'.
Problem reported by Robin Watts <robin.watts@artifex.com>.
* src/base/ftoutln.c (FT_Outline_New_Internal): Ensure that
`numContours' and `numPoints' fit into FT_Outline's `n_points' and
`n_contours', respectively.
2012-12-20 Werner Lemberg <wl@gnu.org>
* Version 2.4.11 released.

2
include/freetype/ftoutln.h
View File

@ -126,8 +126,10 @@ FT_BEGIN_HEADER
/* destroying the library, by @FT_Done_FreeType. */
/* */
/* numPoints :: The maximum number of points within the outline. */
/* Must be smaller than or equal to 0xFFFF (65535). */
/* */
/* numContours :: The maximum number of contours within the outline. */
/* This value must be in the range 0 to `numPoints'. */
/* */
/* <Output> */
/* anoutline :: A handle to the new outline. */

7
src/base/ftoutln.c
View File

@ -304,6 +304,13 @@
*anoutline = null_outline;
if ( numContours < 0 ||
(FT_UInt)numContours > numPoints )
return FT_Err_Invalid_Argument;
if ( numPoints > FT_OUTLINE_POINTS_MAX )
return FT_Err_Array_Too_Large;
if ( FT_NEW_ARRAY( anoutline->points, numPoints ) ||
FT_NEW_ARRAY( anoutline->tags, numPoints ) ||
FT_NEW_ARRAY( anoutline->contours, numContours ) )