зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1672223 - [sfnt] Fix heap buffer overflow. r=jfkthame
This is CVE-2020-15999. * src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier. Differential Revision: https://phabricator.services.mozilla.com/D94153
This commit is contained in:
Родитель
0a9a2f1c6a
Коммит
0bd550157a
|
@ -328,6 +328,13 @@
|
||||||
|
|
||||||
if ( populate_map_and_metrics )
|
if ( populate_map_and_metrics )
|
||||||
{
|
{
|
||||||
|
/* reject too large bitmaps similarly to the rasterizer */
|
||||||
|
if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
|
||||||
|
{
|
||||||
|
error = FT_THROW( Array_Too_Large );
|
||||||
|
goto DestroyExit;
|
||||||
|
}
|
||||||
|
|
||||||
metrics->width = (FT_UShort)imgWidth;
|
metrics->width = (FT_UShort)imgWidth;
|
||||||
metrics->height = (FT_UShort)imgHeight;
|
metrics->height = (FT_UShort)imgHeight;
|
||||||
|
|
||||||
|
@ -336,13 +343,6 @@
|
||||||
map->pixel_mode = FT_PIXEL_MODE_BGRA;
|
map->pixel_mode = FT_PIXEL_MODE_BGRA;
|
||||||
map->pitch = (int)( map->width * 4 );
|
map->pitch = (int)( map->width * 4 );
|
||||||
map->num_grays = 256;
|
map->num_grays = 256;
|
||||||
|
|
||||||
/* reject too large bitmaps similarly to the rasterizer */
|
|
||||||
if ( map->rows > 0x7FFF || map->width > 0x7FFF )
|
|
||||||
{
|
|
||||||
error = FT_THROW( Array_Too_Large );
|
|
||||||
goto DestroyExit;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* convert palette/gray image to rgb */
|
/* convert palette/gray image to rgb */
|
||||||
|
|
Загрузка…
Ссылка в новой задаче