|
 |
b35c50 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b35c50 |
From: Zhang Boyang <zhangboyang.id@gmail.com>
|
|
|
b35c50 |
Date: Wed, 3 Aug 2022 19:45:33 +0800
|
|
|
b35c50 |
Subject: [PATCH] font: Reject glyphs exceeds font->max_glyph_width or
|
|
|
b35c50 |
font->max_glyph_height
|
|
|
b35c50 |
|
|
|
b35c50 |
Check glyph's width and height against limits specified in font's
|
|
|
b35c50 |
metadata. Reject the glyph (and font) if such limits are exceeded.
|
|
|
b35c50 |
|
|
|
b35c50 |
Signed-off-by: Zhang Boyang <zhangboyang.id@gmail.com>
|
|
|
b35c50 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b35c50 |
(cherry picked from commit 5760fcfd466cc757540ea0d591bad6a08caeaa16)
|
|
|
b35c50 |
---
|
|
|
b35c50 |
grub-core/font/font.c | 4 +++-
|
|
|
b35c50 |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
b35c50 |
|
|
|
b35c50 |
diff --git a/grub-core/font/font.c b/grub-core/font/font.c
|
|
|
b35c50 |
index d09bb38d89..2f09a4a55b 100644
|
|
|
b35c50 |
--- a/grub-core/font/font.c
|
|
|
b35c50 |
+++ b/grub-core/font/font.c
|
|
|
b35c50 |
@@ -760,7 +760,9 @@ grub_font_get_glyph_internal (grub_font_t font, grub_uint32_t code)
|
|
|
b35c50 |
|| read_be_uint16 (font->file, &height) != 0
|
|
|
b35c50 |
|| read_be_int16 (font->file, &xoff) != 0
|
|
|
b35c50 |
|| read_be_int16 (font->file, &yoff) != 0
|
|
|
b35c50 |
- || read_be_int16 (font->file, &dwidth) != 0)
|
|
|
b35c50 |
+ || read_be_int16 (font->file, &dwidth) != 0
|
|
|
b35c50 |
+ || width > font->max_char_width
|
|
|
b35c50 |
+ || height > font->max_char_height)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
remove_font (font);
|
|
|
b35c50 |
return 0;
|