From 0f2d3fad3474ea6c2fe747d6106a68ba493e6738 Mon Sep 17 00:00:00 2001 From: Seigo Nonaka Date: Wed, 21 Oct 2020 19:22:22 -0700 Subject: [PATCH] Cherry-pick one upstream patch The original commit in upstream patch is http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab162b2ae616074c8877a04556932998aeacd Bug: 171232105 Test: m -j Change-Id: Ib9e82430d1c8a232dc7d86848c807948a35ee55e --- src/sfnt/pngshim.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c index 96fc08e3b..319b15d52 100644 --- a/src/sfnt/pngshim.c +++ b/src/sfnt/pngshim.c @@ -259,6 +259,13 @@ if ( populate_map_and_metrics ) { + /* reject too large bitmaps similarly to the rasterizer */ + if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF ) + { + error = FT_THROW( Array_Too_Large ); + goto DestroyExit; + } + metrics->width = (FT_UShort)imgWidth; metrics->height = (FT_UShort)imgHeight; @@ -267,13 +274,6 @@ map->pixel_mode = FT_PIXEL_MODE_BGRA; map->pitch = (int)( map->width * 4 ); map->num_grays = 256; - - /* reject too large bitmaps similarly to the rasterizer */ - if ( map->rows > 0x7FFF || map->width > 0x7FFF ) - { - error = FT_THROW( Array_Too_Large ); - goto DestroyExit; - } } /* convert palette/gray image to rgb */