shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[base] Avoid negative bitmap stroke dimensions (#48985).

* src/base/ftobjs.c (FT_Open_Face): Check whether negation was
actually successful.  For example, this can fail for value
-32768 if the type is `signed short'.  If there are problems,
disable the stroke.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,5 +1,14 @@

 2016-09-03  Werner Lemberg  <[email protected]>

+	[base] Avoid negative bitmap stroke dimensions (#48985).

+

+	* src/base/ftobjs.c (FT_Open_Face): Check whether negation was

+	actually successful.  For example, this can fail for value

+	-32768 if the type is `signed short'.  If there are problems,

+	disable the stroke.

+

+2016-09-03  Werner Lemberg  <[email protected]>

+

 	[cff] Avoid null pointer passed to FT_MEM_COPY (#48984).

 	* src/cff/cffload.c (cff_index_get_name): Check `byte_len'.

--- a/src/base/ftobjs.c

+++ b/src/base/ftobjs.c

@@ -2314,11 +2314,24 @@

         if ( bsize->height < 0 )

-          bsize->height = (FT_Short)-bsize->height;

+          bsize->height = -bsize->height;

         if ( bsize->x_ppem < 0 )

-          bsize->x_ppem = (FT_Short)-bsize->x_ppem;

+          bsize->x_ppem = -bsize->x_ppem;

         if ( bsize->y_ppem < 0 )

           bsize->y_ppem = -bsize->y_ppem;

+

+        /* check whether negation actually has worked */

+        if ( bsize->height < 0 || bsize->x_ppem < 0 || bsize->y_ppem < 0 )

+        {

+          FT_TRACE0(( "FT_Open_Face:"

+                      " Invalid bitmap dimensions for stroke %d,"

+                      " now disabled\n", i ));

+          bsize->width  = 0;

+          bsize->height = 0;

+          bsize->size   = 0;

+          bsize->x_ppem = 0;

+          bsize->y_ppem = 0;

+        }

       }

     }