Chiebot-Mirror
/
freetype
mirror of https://github.com/freetype/freetype.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

[raster, smooth] Reinstate bitmap size limits.

Browse Source 
This again moves outline and bitmap size checks one level up.

* src/base/ftoutln.c (FT_Outline_Render): Explicitly reject enormous
outlines.
* src/raster/ftrend1.c (ft_raster1_render): Reject enormous bitmaps
and, therefore, outlines that require them.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Ditto.

* src/raster/ftraster.c (ft_black_render): Remove outline size checks.
* src/smooth/ftgrays.c (gray_raster_render): Ditto.
[STANDALONE]: Remove `FT_Outline_Get_CBox' copy.
color
Alexei Podtelezhnikov 6 years ago
parent 6a97c95800
commit e16bfbec4c
6 changed files with 47 additions and 129 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 16
      ChangeLog
  2. 6
      src/base/ftoutln.c
  3. 19
      src/raster/ftraster.c
  4. 8
      src/raster/ftrend1.c
  5. 119
      src/smooth/ftgrays.c
  6. 8
      src/smooth/ftsmooth.c

16
ChangeLog
Unescape View File

@ -1,3 +1,19 @@
2018-08-09 Alexei Podtelezhnikov <apodtele@gmail.com>
[raster, smooth] Reinstate bitmap size limits.
This again moves outline and bitmap size checks one level up.
* src/base/ftoutln.c (FT_Outline_Render): Explicitly reject enormous
outlines.
* src/raster/ftrend1.c (ft_raster1_render): Reject enormous bitmaps
and, therefore, outlines that require them.
* src/smooth/ftsmooth.c (ft_smooth_render_generic): Ditto.
* src/raster/ftraster.c (ft_black_render): Remove outline size checks.
* src/smooth/ftgrays.c (gray_raster_render): Ditto.
[STANDALONE]: Remove `FT_Outline_Get_CBox' copy.
2018-08-08 Alexei Podtelezhnikov <apodtele@gmail.com>
[pcf] Revert massive unsigning.

6
src/base/ftoutln.c
Unescape View File

@ -619,6 +619,7 @@
FT_Error error;
FT_Renderer renderer;
FT_ListNode node;
FT_BBox cbox;
if ( !library )
@ -630,6 +631,11 @@
if ( !params )
return FT_THROW( Invalid_Argument );
FT_Outline_Get_CBox( outline, &cbox );
if ( cbox.xMin < -0x1000000L || cbox.yMin < -0x1000000L ||
cbox.xMax > 0x1000000L || cbox.yMax > 0x1000000L )
return FT_THROW( Invalid_Outline );
renderer = library->cur_renderer;
node = library->renderers.head;

19
src/raster/ftraster.c
Unescape View File

@ -3251,7 +3251,6 @@
{
const FT_Outline* outline = (const FT_Outline*)params->source;
const FT_Bitmap* target_map = params->target;
FT_BBox cbox;
black_TWorker worker[1];
@ -3292,24 +3291,6 @@
if ( !target_map->buffer )
return FT_THROW( Invalid );
FT_Outline_Get_CBox( outline, &cbox );
/* reject too large outline coordinates */
if ( cbox.xMin < -0x1000000L || cbox.xMax > 0x1000000L ||
cbox.yMin < -0x1000000L || cbox.yMax > 0x1000000L )
return FT_THROW( Invalid );
/* truncate the bounding box to integer pixels */
cbox.xMin = cbox.xMin >> 6;
cbox.yMin = cbox.yMin >> 6;
cbox.xMax = ( cbox.xMax + 63 ) >> 6;
cbox.yMax = ( cbox.yMax + 63 ) >> 6;
/* reject too large glyphs */
if ( cbox.xMax - cbox.xMin > 0xFFFF ||
cbox.yMax - cbox.yMin > 0xFFFF )
return FT_THROW( Invalid );
ras.outline = *outline;
ras.target = *target_map;

8
src/raster/ftrend1.c
Unescape View File

@ -129,6 +129,14 @@
ft_glyphslot_preset_bitmap( slot, mode, origin );
if ( bitmap->width > 0x7FFF || bitmap->rows > 0x7FFF )
{
FT_ERROR(( "ft_raster1_render: glyph is too large: %u x %u\n",
bitmap->width, bitmap->rows ));
error = FT_THROW( Raster_Overflow );
goto Exit;
}
/* allocate new one */
if ( FT_ALLOC_MULT( bitmap->buffer, bitmap->rows, bitmap->pitch ) )
goto Exit;

119
src/smooth/ftgrays.c
Unescape View File

@ -1611,83 +1611,6 @@ typedef ptrdiff_t FT_PtrDist;
return FT_THROW( Invalid_Outline );
}
/**************************************************************************
*
* @Function:
* FT_Outline_Get_CBox
*
* @Description:
* Return an outline's `control box'. The control box encloses all
* the outline's points, including Bézier control points. Though it
* coincides with the exact bounding box for most glyphs, it can be
* slightly larger in some situations (like when rotating an outline
* that contains Bézier outside arcs).
*
* Computing the control box is very fast, while getting the bounding
* box can take much more time as it needs to walk over all segments
* and arcs in the outline. To get the latter, you can use the
* `ftbbox' component, which is dedicated to this single task.
*
* @Input:
* outline ::
* A pointer to the source outline descriptor.
*
* @Output:
* acbox ::
* The outline's control box.
*
* @Note:
* See @FT_Glyph_Get_CBox for a discussion of tricky fonts.
*/
static void
FT_Outline_Get_CBox( const FT_Outline* outline,
FT_BBox *acbox )
{
TPos xMin, yMin, xMax, yMax;
if ( outline && acbox )
{
if ( outline->n_points == 0 )
{
xMin = 0;
yMin = 0;
xMax = 0;
yMax = 0;
}
else
{
FT_Vector* vec = outline->points;
FT_Vector* limit = vec + outline->n_points;
xMin = xMax = vec->x;
yMin = yMax = vec->y;
vec++;
for ( ; vec < limit; vec++ )
{
TPos x, y;
x = vec->x;
if ( x < xMin ) xMin = x;
if ( x > xMax ) xMax = x;
y = vec->y;
if ( y < yMin ) yMin = y;
if ( y > yMax ) yMax = y;
}
}
acbox->xMin = xMin;
acbox->xMax = xMax;
acbox->yMin = yMin;
acbox->yMax = yMax;
}
}
#endif /* STANDALONE_ */
@ -1832,7 +1755,7 @@ typedef ptrdiff_t FT_PtrDist;
{
const FT_Outline* outline = (const FT_Outline*)params->source;
const FT_Bitmap* target_map = params->target;
FT_BBox cbox, clip;
FT_BBox clip;
#ifndef FT_STATIC_RASTER
gray_TWorker worker[1];
@ -1895,26 +1818,11 @@ typedef ptrdiff_t FT_PtrDist;
ras.render_span_data = NULL;
}
FT_Outline_Get_CBox( outline, &cbox );
/* reject too large outline coordinates */
if ( cbox.xMin < -0x1000000L || cbox.xMax > 0x1000000L ||
cbox.yMin < -0x1000000L || cbox.yMax > 0x1000000L )
return FT_THROW( Invalid_Outline );
/* truncate the bounding box to integer pixels */
cbox.xMin = cbox.xMin >> 6;
cbox.yMin = cbox.yMin >> 6;
cbox.xMax = ( cbox.xMax + 63 ) >> 6;
cbox.yMax = ( cbox.yMax + 63 ) >> 6;
/* reject too large glyphs */
if ( cbox.xMax - cbox.xMin > 0xFFFF ||
cbox.yMax - cbox.yMin > 0xFFFF )
return FT_THROW( Invalid_Outline );
/* compute clipping box */
if ( !( params->flags & FT_RASTER_FLAG_DIRECT ) )
if ( params->flags & FT_RASTER_FLAG_DIRECT &&
params->flags & FT_RASTER_FLAG_CLIP )
clip = params->clip_box;
else
{
/* compute clip box from target pixmap */
clip.xMin = 0;
@ -1922,21 +1830,12 @@ typedef ptrdiff_t FT_PtrDist;
clip.xMax = (FT_Pos)target_map->width;
clip.yMax = (FT_Pos)target_map->rows;
}
else if ( params->flags & FT_RASTER_FLAG_CLIP )
clip = params->clip_box;
else
{
clip.xMin = -32768L;
clip.yMin = -32768L;
clip.xMax = 32767L;
clip.yMax = 32767L;
}
/* clip to target bitmap, exit if nothing to do */
ras.min_ex = FT_MAX( cbox.xMin, clip.xMin );
ras.min_ey = FT_MAX( cbox.yMin, clip.yMin );
ras.max_ex = FT_MIN( cbox.xMax, clip.xMax );
ras.max_ey = FT_MIN( cbox.yMax, clip.yMax );
ras.min_ex = clip.xMin;
ras.min_ey = clip.yMin;
ras.max_ex = clip.xMax;
ras.max_ey = clip.yMax;
if ( ras.max_ex <= ras.min_ex || ras.max_ey <= ras.min_ey )
return 0;

8
src/smooth/ftsmooth.c
Unescape View File

@ -147,6 +147,14 @@
ft_glyphslot_preset_bitmap( slot, mode, origin );
if ( bitmap->width > 0x7FFF || bitmap->rows > 0x7FFF )
{
FT_ERROR(( "ft_smooth_render_generic: glyph is too large: %u x %u\n",
bitmap->width, bitmap->rows ));
error = FT_THROW( Raster_Overflow );
goto Exit;
}
/* allocate new one */
if ( FT_ALLOC_MULT( bitmap->buffer, bitmap->rows, bitmap->pitch ) )
goto Exit;

Write Preview
Loading…
Cancel
Save