diff options
author | Werner Lemberg <wl@gnu.org> | 2016-08-13 06:53:53 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2016-08-13 06:53:53 +0200 |
commit | 248f5629d8889aa5b77ea5bfce0935140293d50d (patch) | |
tree | 8a737f8cbc09ecc8408db930003a0ebf242c7d35 /src/winfonts/winfnt.c | |
parent | 125f2b63a503ecb1f78f86b4ebfb0303c0a46788 (diff) | |
download | freetype2-248f5629d8889aa5b77ea5bfce0935140293d50d.tar.gz |
[winfonts] Avoid zero bitmap width and height.
Reported as
https://bugzilla.mozilla.org/show_bug.cgi?id=1272173
* src/winfonts/winfnt.c (FNT_Face_Init): Check zero pixel height.
(FNT_Load_Glyph): Check for zero pitch.
Diffstat (limited to 'src/winfonts/winfnt.c')
-rw-r--r-- | src/winfonts/winfnt.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/winfonts/winfnt.c b/src/winfonts/winfnt.c index 1c74ccd5a..a0a18001b 100644 --- a/src/winfonts/winfnt.c +++ b/src/winfonts/winfnt.c @@ -759,6 +759,14 @@ if ( error ) goto Fail; + /* sanity check */ + if ( !face->font->header.pixel_height ) + { + FT_TRACE2(( "invalid pixel height\n" )); + error = FT_THROW( Invalid_File_Format ); + goto Fail; + } + /* we now need to fill the root FT_Face fields */ /* with relevant information */ { @@ -1062,7 +1070,8 @@ bitmap->rows = font->header.pixel_height; bitmap->pixel_mode = FT_PIXEL_MODE_MONO; - if ( offset + pitch * bitmap->rows > font->header.file_size ) + if ( !pitch || + offset + pitch * bitmap->rows > font->header.file_size ) { FT_TRACE2(( "invalid bitmap width\n" )); error = FT_THROW( Invalid_File_Format ); |