diff options
author | Werner Lemberg <wl@gnu.org> | 2017-06-01 17:00:37 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2017-06-01 17:00:37 +0200 |
commit | 0ad326236607df0802dc72c4f13b3f35484b7672 (patch) | |
tree | d9ca43faba95a8251ebdd5571a1153175a3b169c | |
parent | 4a1f1a6d2a5118ae45f0f950a824ad7a1363a044 (diff) | |
download | freetype2-0ad326236607df0802dc72c4f13b3f35484b7672.tar.gz |
* src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | src/base/ftglyph.c | 13 |
2 files changed, 17 insertions, 0 deletions
@@ -1,5 +1,9 @@ 2017-06-01 Werner Lemberg <wl@gnu.org> + * src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'. + +2017-06-01 Werner Lemberg <wl@gnu.org> + [psaux] 32bit integer overflow tun-time errors (#46149). * src/psaux/t1decode.c (t1_decoder_parse_charstrings): Use diff --git a/src/base/ftglyph.c b/src/base/ftglyph.c index 9bfb33050..62d94cbd3 100644 --- a/src/base/ftglyph.c +++ b/src/base/ftglyph.c @@ -408,6 +408,19 @@ goto Exit; /* copy advance while converting 26.6 to 16.16 format */ + if ( slot->advance.x >= 0x8000L * 64 || + slot->advance.x <= -0x8000L * 64 ) + { + FT_ERROR(( "FT_Get_Glyph: advance width too large\n" )); + return FT_THROW( Invalid_Argument ); + } + if ( slot->advance.y >= 0x8000L * 64 || + slot->advance.y <= -0x8000L * 64 ) + { + FT_ERROR(( "FT_Get_Glyph: advance height too large\n" )); + return FT_THROW( Invalid_Argument ); + } + glyph->advance.x = slot->advance.x * 1024; glyph->advance.y = slot->advance.y * 1024; |