Attachment #86119 for bug #124828

Lines 1-3 Link Here

(-)a/ChangeLog (+8 lines)
		1	2006-03-26 Werner Lemberg <wl@gnu.org>
		2
		3	* src/bdf/bdflib.c (ERRMSG4): New macro.
		4	(_bdf_parse_glyphs): Handle invalid BBX values.
		5
		6	* include/freetype/fterrdef.h (FT_Err_Bbx_Too_Big): New error
		7	macro.
		8
1	2006-03-23 Werner Lemberg <wl@gnu.org>	9	2006-03-23 Werner Lemberg <wl@gnu.org>
2		10
3	* docs/CHANGES: Updated.	11	* docs/CHANGES: Updated.

Lines 4-10 Link Here

(-)a/include/freetype/fterrdef.h (-1 / +3 lines)
4	/* */	4	/* */
5	/* FreeType error codes (specification). */	5	/* FreeType error codes (specification). */
6	/* */	6	/* */
7	/* Copyright 2002, 2004 by */	7	/* Copyright 2002, 2004, 2006 by */
8	/* David Turner, Robert Wilhelm, and Werner Lemberg. */	8	/* David Turner, Robert Wilhelm, and Werner Lemberg. */
9	/* */	9	/* */
10	/* This file is part of the FreeType project, and may only be used, */	10	/* This file is part of the FreeType project, and may only be used, */
Lines 226-231 Link Here
226	"`ENCODING' field missing" )	226	"`ENCODING' field missing" )
227	FT_ERRORDEF_( Missing_Bbx_Field, 0xB6, \	227	FT_ERRORDEF_( Missing_Bbx_Field, 0xB6, \
228	"`BBX' field missing" )	228	"`BBX' field missing" )
		229	FT_ERRORDEF_( Bbx_Too_Big, 0xB7, \
		230	"`BBX' too big" )
229		231
230		232
231	/* END */	233	/* END */

Lines 1092-1097 Link Here

(-)a/src/bdf/bdflib.c (-1 / +14 lines)
1092	#define ERRMSG1 "[line %ld] Missing \"%s\" line.\n"	1092	#define ERRMSG1 "[line %ld] Missing \"%s\" line.\n"
1093	#define ERRMSG2 "[line %ld] Font header corrupted or missing fields.\n"	1093	#define ERRMSG2 "[line %ld] Font header corrupted or missing fields.\n"
1094	#define ERRMSG3 "[line %ld] Font glyphs corrupted or missing fields.\n"	1094	#define ERRMSG3 "[line %ld] Font glyphs corrupted or missing fields.\n"
		1095	#define ERRMSG4 "[line %ld] BBX too big.\n"
1095		1096
1096		1097
1097	static FT_Error	1098	static FT_Error
Lines 1814-1819 Link Here
1814	/* And finally, gather up the bitmap. */	1815	/* And finally, gather up the bitmap. */
1815	if ( ft_memcmp( line, "BITMAP", 6 ) == 0 )	1816	if ( ft_memcmp( line, "BITMAP", 6 ) == 0 )
1816	{	1817	{
		1818	unsigned long bitmap_size;
		1819
		1820
1817	if ( !( p->flags & _BDF_BBX ) )	1821	if ( !( p->flags & _BDF_BBX ) )
1818	{	1822	{
1819	/* Missing BBX field. */	1823	/* Missing BBX field. */
Lines 1824-1830 Link Here
1824		1828
1825	/* Allocate enough space for the bitmap. */	1829	/* Allocate enough space for the bitmap. */
1826	glyph->bpr = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3;	1830	glyph->bpr = ( glyph->bbx.width * p->font->bpp + 7 ) >> 3;
1827	glyph->bytes = (unsigned short)( glyph->bpr * glyph->bbx.height );	1831
		1832	bitmap_size = glyph->bpr * glyph->bbx.height;
		1833	if ( bitmap_size > 0xFFFFU )
		1834	{
		1835	FT_ERROR(( "_bdf_parse_glyphs: " ERRMSG4, lineno ));
		1836	error = BDF_Err_Bbx_Too_Big;
		1837	goto Exit;
		1838	}
		1839	else
		1840	glyph->bytes = (unsigned short)bitmap_size;
1828		1841
1829	if ( FT_NEW_ARRAY( glyph->bitmap, glyph->bytes ) )	1842	if ( FT_NEW_ARRAY( glyph->bitmap, glyph->bytes ) )
1830	goto Exit;	1843	goto Exit;

Return to bug 124828