[base] Avoid negative bitmap stroke dimensions (#48985).

* src/base/ftobjs.c (FT_Open_Face): Check whether negation was
actually successful.  For example, this can fail for value
-32768 if the type is `signed short'.  If there are problems,
disable the stroke.

1 files changed, 15 insertions, 2 deletions

diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c
index 7a78357e1..0c9e4090c 100644
--- a/src/base/ftobjs.c
+++ b/src/base/ftobjs.c
@@ -2314,11 +2314,24 @@
 
 
         if ( bsize->height < 0 )
-          bsize->height = (FT_Short)-bsize->height;
+          bsize->height = -bsize->height;
         if ( bsize->x_ppem < 0 )
-          bsize->x_ppem = (FT_Short)-bsize->x_ppem;
+          bsize->x_ppem = -bsize->x_ppem;
         if ( bsize->y_ppem < 0 )
           bsize->y_ppem = -bsize->y_ppem;
+
+        /* check whether negation actually has worked */
+        if ( bsize->height < 0 || bsize->x_ppem < 0 || bsize->y_ppem < 0 )
+        {
+          FT_TRACE0(( "FT_Open_Face:"
+                      " Invalid bitmap dimensions for stroke %d,"
+                      " now disabled\n", i ));
+          bsize->width  = 0;
+          bsize->height = 0;
+          bsize->size   = 0;
+          bsize->x_ppem = 0;
+          bsize->y_ppem = 0;
+        }
       }
     }