From d16501708969ff79b00098437e18d0d4b7e6377f Mon Sep 17 00:00:00 2001 From: Alex Kontos Date: Tue, 20 Oct 2020 14:17:06 +0100 Subject: [PATCH] Merge pull request #1797 from aeiouaeiouaeiouaeiouaeiouaeiou/classic-freetype2 CVE-2020-15999 --- modules/freetype2/ChangeLog | 8 ++++++++ modules/freetype2/src/sfnt/pngshim.c | 14 +++++++------- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/modules/freetype2/ChangeLog b/modules/freetype2/ChangeLog index 806b8354a9063..3fe0abf93d9a3 100644 --- a/modules/freetype2/ChangeLog +++ b/modules/freetype2/ChangeLog @@ -1,3 +1,11 @@ +2020-10-19 Werner Lemberg + + [sfnt] Fix heap buffer overflow (#59308). + + This is CVE-2020-15999. + + * src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier. + 2018-05-01 Werner Lemberg * Version 2.9.1 released. diff --git a/modules/freetype2/src/sfnt/pngshim.c b/modules/freetype2/src/sfnt/pngshim.c index 16020266afd5e..7d856af539221 100644 --- a/modules/freetype2/src/sfnt/pngshim.c +++ b/modules/freetype2/src/sfnt/pngshim.c @@ -327,6 +327,13 @@ if ( populate_map_and_metrics ) { + /* reject too large bitmaps similarly to the rasterizer */ + if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF ) + { + error = FT_THROW( Array_Too_Large ); + goto DestroyExit; + } + metrics->width = (FT_UShort)imgWidth; metrics->height = (FT_UShort)imgHeight; @@ -335,13 +342,6 @@ map->pixel_mode = FT_PIXEL_MODE_BGRA; map->pitch = (int)( map->width * 4 ); map->num_grays = 256; - - /* reject too large bitmaps similarly to the rasterizer */ - if ( map->rows > 0x7FFF || map->width > 0x7FFF ) - { - error = FT_THROW( Array_Too_Large ); - goto DestroyExit; - } } /* convert palette/gray image to rgb */