b4a942
From a3bab162b2ae616074c8877a04556932998aeacd Mon Sep 17 00:00:00 2001
b4a942
From: Werner Lemberg <wl@gnu.org>
b4a942
Date: Mon, 19 Oct 2020 23:45:28 +0200
b4a942
Subject: [PATCH] [sfnt] Fix heap buffer overflow (#59308).
b4a942
b4a942
This is CVE-2020-15999.
b4a942
b4a942
* src/sfnt/pngshim.c (Load_SBit_Png): Test bitmap size earlier.
b4a942
---
b4a942
 ChangeLog          |  8 ++++++++
b4a942
 src/sfnt/pngshim.c | 14 +++++++-------
b4a942
 2 files changed, 15 insertions(+), 7 deletions(-)
b4a942
b4a942
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
b4a942
index 2e64e5846..f55016122 100644
b4a942
--- a/src/sfnt/pngshim.c
b4a942
+++ b/src/sfnt/pngshim.c
b4a942
@@ -332,6 +332,13 @@
b4a942
 
b4a942
     if ( populate_map_and_metrics )
b4a942
     {
b4a942
+      /* reject too large bitmaps similarly to the rasterizer */
b4a942
+      if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
b4a942
+      {
b4a942
+        error = FT_THROW( Array_Too_Large );
b4a942
+        goto DestroyExit;
b4a942
+      }
b4a942
+
b4a942
       metrics->width  = (FT_UShort)imgWidth;
b4a942
       metrics->height = (FT_UShort)imgHeight;
b4a942
 
b4a942
@@ -340,13 +347,6 @@
b4a942
       map->pixel_mode = FT_PIXEL_MODE_BGRA;
b4a942
       map->pitch      = (int)( map->width * 4 );
b4a942
       map->num_grays  = 256;
b4a942
-
b4a942
-      /* reject too large bitmaps similarly to the rasterizer */
b4a942
-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
b4a942
-      {
b4a942
-        error = FT_THROW( Array_Too_Large );
b4a942
-        goto DestroyExit;
b4a942
-      }
b4a942
     }
b4a942
 
b4a942
     /* convert palette/gray image to rgb */
b4a942
-- 
b4a942
2.26.2
b4a942