wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-28 18:17:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

[sfnt] Fix heap buffer overflow.

Browse source 
This is CVE-2020-15999.

* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.
This commit is contained in:
Werner Lemberg 2020-11-19 19:18:32 +00:00 • committed by roytam1
commit 94187c71cf
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
modules/freetype2/src/sfnt/pngshim.c
View file

@ -327,6 +327,13 @@
if ( populate_map_and_metrics ) if ( populate_map_and_metrics )
{ {
/* reject too large bitmaps similarly to the rasterizer */
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
{
error = FT_THROW( Array_Too_Large );
goto DestroyExit;
}
metrics->width = (FT_UShort)imgWidth; metrics->width = (FT_UShort)imgWidth;
metrics->height = (FT_UShort)imgHeight; metrics->height = (FT_UShort)imgHeight;
@ -335,13 +342,6 @@
map->pixel_mode = FT_PIXEL_MODE_BGRA; map->pixel_mode = FT_PIXEL_MODE_BGRA;
map->pitch = (int)( map->width * 4 ); map->pitch = (int)( map->width * 4 );
map->num_grays = 256; map->num_grays = 256;
/* reject too large bitmaps similarly to the rasterizer */
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
{
error = FT_THROW( Array_Too_Large );
goto DestroyExit;
}
} }
/* convert palette/gray image to rgb */ /* convert palette/gray image to rgb */