45 lines
1.4 KiB
Diff
45 lines
1.4 KiB
Diff
From a3bab162b2ae616074c8877a04556932998aeacd Mon Sep 17 00:00:00 2001
|
||
From: Werner Lemberg <wl@gnu.org>
|
||
Date: Mon, 19 Oct 2020 23:45:28 +0200
|
||
Subject: [sfnt] Fix heap buffer overflow (#59308).
|
||
This is CVE-2020-15999.
|
||
* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.
|
||
reference：https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab162b2ae616074c8877a04556932998aeacd
|
||
---
|
||
src/sfnt/pngshim.c | 14 +++++++-------
|
||
1 file changed, 7 insertions(+), 7 deletions(-)
|
||
|
||
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
|
||
index 523b30a..5502108 100644
|
||
--- a/src/sfnt/pngshim.c
|
||
+++ b/src/sfnt/pngshim.c
|
||
@@ -328,6 +328,13 @@
|
||
|
||
if ( populate_map_and_metrics )
|
||
{
|
||
+ /* reject too large bitmaps similarly to the rasterizer */
|
||
+ if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
|
||
+ {
|
||
+ error = FT_THROW( Array_Too_Large );
|
||
+ goto DestroyExit;
|
||
+ }
|
||
+
|
||
metrics->width = (FT_UShort)imgWidth;
|
||
metrics->height = (FT_UShort)imgHeight;
|
||
|
||
@@ -336,13 +343,6 @@
|
||
map->pixel_mode = FT_PIXEL_MODE_BGRA;
|
||
map->pitch = (int)( map->width * 4 );
|
||
map->num_grays = 256;
|
||
-
|
||
- /* reject too large bitmaps similarly to the rasterizer */
|
||
- if ( map->rows > 0x7FFF || map->width > 0x7FFF )
|
||
- {
|
||
- error = FT_THROW( Array_Too_Large );
|
||
- goto DestroyExit;
|
||
- }
|
||
}
|
||
|
||
/* convert palette/gray image to rgb */
|
||
--
|
||
2.27.0
|