[sfnt] Fix heap buffer overflow.
This commit is contained in:
parent
e27317d58f
commit
b7459cf8ab
|
@ -327,6 +327,13 @@
|
||||||
|
|
||||||
if ( populate_map_and_metrics )
|
if ( populate_map_and_metrics )
|
||||||
{
|
{
|
||||||
|
/* reject too large bitmaps similarly to the rasterizer */
|
||||||
|
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
|
||||||
|
{
|
||||||
|
error = FT_THROW( Array_Too_Large );
|
||||||
|
goto DestroyExit;
|
||||||
|
}
|
||||||
|
|
||||||
metrics->width = (FT_UShort)imgWidth;
|
metrics->width = (FT_UShort)imgWidth;
|
||||||
metrics->height = (FT_UShort)imgHeight;
|
metrics->height = (FT_UShort)imgHeight;
|
||||||
|
|
||||||
|
@ -335,13 +342,6 @@
|
||||||
map->pixel_mode = FT_PIXEL_MODE_BGRA;
|
map->pixel_mode = FT_PIXEL_MODE_BGRA;
|
||||||
map->pitch = (int)( map->width * 4 );
|
map->pitch = (int)( map->width * 4 );
|
||||||
map->num_grays = 256;
|
map->num_grays = 256;
|
||||||
|
|
||||||
/* reject too large bitmaps similarly to the rasterizer */
|
|
||||||
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
|
|
||||||
{
|
|
||||||
error = FT_THROW( Array_Too_Large );
|
|
||||||
goto DestroyExit;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* convert palette/gray image to rgb */
|
/* convert palette/gray image to rgb */
|
||||||
|
|
Loading…
Reference in New Issue