AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

check for 0 upem in freetype

Browse Source 
add 32bit-overflow check



git-svn-id: http://skia.googlecode.com/svn/trunk@165 2bbb7eff-a529-9590-31e7-b0007b416f81
This commit is contained in:
reed@android.com 2009-05-04 15:00:11 +00:00
parent f9ab99aaad
commit a8a8b8b80e
2 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/images/SkImageDecoder_libpng.cpp
View File

@ -259,7 +259,20 @@ bool SkPNGImageDecoder::onDecode(SkStream* sk_stream, SkBitmap* decodedBitmap,
}
}
}
// sanity check for size
{
Sk64 size;
size.setMul(origWidth, origHeight);
if (size.isNeg() || !size.is32()) {
return false;
}
// now check that if we are 4-bytes per pixel, we also don't overflow
if (size.get32() > (0x7FFFFFFF >> 2)) {
return false;
}
}
if (!this->chooseFromOneChoice(config, origWidth, origHeight)) {
return false;
}
@ -396,7 +409,7 @@ bool SkPNGImageDecoder::onDecode(SkStream* sk_stream, SkBitmap* decodedBitmap,
SkAutoMalloc storage(origWidth * origHeight * srcBytesPerPixel);
uint8_t* base = (uint8_t*)storage.get();
size_t rb = origWidth * srcBytesPerPixel;
for (int i = 0; i < number_passes; i++) {
uint8_t* row = base;
for (png_uint_32 y = 0; y < origHeight; y++) {

9
src/ports/SkFontHost_FreeType.cpp
View File

@ -750,6 +750,7 @@ void SkScalerContext_FreeType::generateFontMetrics(SkPaint::FontMetrics* mx,
SkAutoMutexAcquire ac(gFTMutex);
if (this->setupSize()) {
ERROR:
if (mx) {
bzero(mx, sizeof(SkPaint::FontMetrics));
}
@ -759,10 +760,14 @@ void SkScalerContext_FreeType::generateFontMetrics(SkPaint::FontMetrics* mx,
return;
}
FT_Face face = fFace;
int upem = face->units_per_EM;
if (upem <= 0) {
goto ERROR;
}
SkPoint pts[6];
SkFixed ys[6];
FT_Face face = fFace;
int upem = face->units_per_EM;
SkFixed scaleY = fScaleY;
SkFixed mxy = fMatrix22.xy;
SkFixed myy = fMatrix22.yy;