Skip to content

Commit

Permalink
Merge pull request #1797 from aeiouaeiouaeiouaeiouaeiouaeiou/classic-…
Browse files Browse the repository at this point in the history
…freetype2

CVE-2020-15999
  • Loading branch information
MrAlex94 authored and Alex Kontos committed Oct 20, 2020
1 parent 1c32914 commit d165017
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 7 deletions.
8 changes: 8 additions & 0 deletions modules/freetype2/ChangeLog
Original file line number Diff line number Diff line change
@@ -1,3 +1,11 @@
2020-10-19 Werner Lemberg <[email protected]>

[sfnt] Fix heap buffer overflow (#59308).

This is CVE-2020-15999.

* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.

2018-05-01 Werner Lemberg <[email protected]>

* Version 2.9.1 released.
Expand Down
14 changes: 7 additions & 7 deletions modules/freetype2/src/sfnt/pngshim.c
Original file line number Diff line number Diff line change
Expand Up @@ -327,6 +327,13 @@

if ( populate_map_and_metrics )
{
/* reject too large bitmaps similarly to the rasterizer */
if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
{
error = FT_THROW( Array_Too_Large );
goto DestroyExit;
}

metrics->width = (FT_UShort)imgWidth;
metrics->height = (FT_UShort)imgHeight;

Expand All @@ -335,13 +342,6 @@
map->pixel_mode = FT_PIXEL_MODE_BGRA;
map->pitch = (int)( map->width * 4 );
map->num_grays = 256;

/* reject too large bitmaps similarly to the rasterizer */
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
{
error = FT_THROW( Array_Too_Large );
goto DestroyExit;
}
}

/* convert palette/gray image to rgb */
Expand Down

0 comments on commit d165017

Please sign in to comment.