diff options
| author | Werner Lemberg <wl@gnu.org> | 2015-11-03 17:30:36 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2015-11-03 17:30:36 +0100 |
| commit | aae8808780d4b73cf51f80ba40c4b7b854ca1487 (patch) | |
| tree | 9ff9fd9d15caf3fbed0450a572399dea66953ce6 /src/sfnt/ttsbit.c | |
| parent | b6fd5bc06c4434a832328c4682544c436484265e (diff) | |
| download | freetype2-aae8808780d4b73cf51f80ba40c4b7b854ca1487.tar.gz | |
[sfnt] Protect against zero-size bitmaps (#46345).
* src/sfnt/ttsbit.c (tt_sbit_decoder_load_bitmap): Check
`glyph_size'.
Diffstat (limited to 'src/sfnt/ttsbit.c')
| -rw-r--r-- | src/sfnt/ttsbit.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c index c0540f356..acc18f01b 100644 --- a/src/sfnt/ttsbit.c +++ b/src/sfnt/ttsbit.c @@ -1025,7 +1025,8 @@ /* seek into the EBDT table now */ - if ( glyph_start + glyph_size > decoder->ebdt_size ) + if ( !glyph_size || + glyph_start + glyph_size > decoder->ebdt_size ) { error = FT_THROW( Invalid_Argument ); goto Exit; |