diff options
author | David 'Digit' Turner <digit@google.com> | 2011-01-26 13:53:40 +0100 |
---|---|---|
committer | David 'Digit' Turner <digit@google.com> | 2011-01-26 13:53:40 +0100 |
commit | 7f08cbd7d6dcf19b8d8e4328e33032aee342e3b4 (patch) | |
tree | f9ed9e041d6830735eae3d4af62e9a602851faea /src/smooth/ftsmooth.c | |
parent | cb487e4c5295d0d9bb96ddd3a27372ffad41ae5b (diff) | |
download | android_external_freetype-7f08cbd7d6dcf19b8d8e4328e33032aee342e3b4.tar.gz android_external_freetype-7f08cbd7d6dcf19b8d8e4328e33032aee342e3b4.tar.bz2 android_external_freetype-7f08cbd7d6dcf19b8d8e4328e33032aee342e3b4.zip |
Upgrade to upstream 2.4.4
This is necessary to fix several security issues. See b/3344697
Change-Id: Ica5c6387fbd791008199f7994ed03978ed700a69
Diffstat (limited to 'src/smooth/ftsmooth.c')
-rw-r--r-- | src/smooth/ftsmooth.c | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/src/smooth/ftsmooth.c b/src/smooth/ftsmooth.c index 7d16b94..eb12f18 100644 --- a/src/smooth/ftsmooth.c +++ b/src/smooth/ftsmooth.c @@ -140,8 +140,26 @@ cbox.xMax = FT_PIX_CEIL( cbox.xMax ); cbox.yMax = FT_PIX_CEIL( cbox.yMax ); - width = (FT_UInt)( ( cbox.xMax - cbox.xMin ) >> 6 ); - height = (FT_UInt)( ( cbox.yMax - cbox.yMin ) >> 6 ); + if ( cbox.xMin < 0 && cbox.xMax > FT_INT_MAX + cbox.xMin ) + { + FT_ERROR(( "ft_smooth_render_generic: glyph too large:" + " xMin = %d, xMax = %d\n", + cbox.xMin >> 6, cbox.xMax >> 6 )); + return Smooth_Err_Raster_Overflow; + } + else + width = (FT_UInt)( ( cbox.xMax - cbox.xMin ) >> 6 ); + + if ( cbox.yMin < 0 && cbox.yMax > FT_INT_MAX + cbox.yMin ) + { + FT_ERROR(( "ft_smooth_render_generic: glyph too large:" + " yMin = %d, yMax = %d\n", + cbox.yMin >> 6, cbox.yMax >> 6 )); + return Smooth_Err_Raster_Overflow; + } + else + height = (FT_UInt)( ( cbox.yMax - cbox.yMin ) >> 6 ); + bitmap = &slot->bitmap; memory = render->root.memory; @@ -202,7 +220,7 @@ /* but we care realistic cases only. Always pitch <= width. */ if ( width > 0x7FFFU || height > 0x7FFFU ) { - FT_ERROR(( "ft_smooth_render_generic: glyph too large: %d x %d\n", + FT_ERROR(( "ft_smooth_render_generic: glyph too large: %u x %u\n", width, height )); return Smooth_Err_Raster_Overflow; } |