Commit ca4e707aa10782a0123011a54bd8c0d7da837b39
2018-06-06T08:18:23
[smooth, raster] Limit bitmap size (#54019). * src/raster/ftraster.c [STANDALONE] (FT_Outline_Get_CBox): Add function. [!STANDALONE]: Include FT_OUTLINE_H. (ft_black_render): Compute CBox and reject glyphs larger than 0xFFFF x 0xFFFF. * src/smooth/ftgrays.c (gray_raster_render): Reject glyphs larger than 0xFFFF x 0xFFFF.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186
diff --git a/ChangeLog b/ChangeLog
index 4f4e281..048f85a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2018-06-06 Werner Lemberg <wl@gnu.org>
+
+ [smooth, raster] Limit bitmap size (#54019).
+
+ * src/raster/ftraster.c [STANDALONE] (FT_Outline_Get_CBox): Add
+ function.
+ [!STANDALONE]: Include FT_OUTLINE_H.
+ (ft_black_render): Compute CBox and reject glyphs larger than
+ 0xFFFF x 0xFFFF.
+
+ * src/smooth/ftgrays.c (gray_raster_render): Reject glyphs larger
+ than 0xFFFF x 0xFFFF.
+
2018-06-03 Armin Hasitzka <prince.cherusker@gmail.com>
* src/smooth/ftgrays.c (gray_convert_glyph): Remove unused variables.
diff --git a/src/raster/ftraster.c b/src/raster/ftraster.c
index e3da008..cc8fd5f 100644
--- a/src/raster/ftraster.c
+++ b/src/raster/ftraster.c
@@ -65,6 +65,7 @@
#include <ft2build.h>
#include "ftraster.h"
#include FT_INTERNAL_CALC_H /* for FT_MulDiv and FT_MulDiv_No_Round */
+#include FT_OUTLINE_H /* for FT_Outline_Get_CBox */
#endif /* !STANDALONE_ */
@@ -2925,6 +2926,94 @@
}
+#ifdef STANDALONE_
+
+ /**************************************************************************
+ *
+ * The following functions should only compile in stand-alone mode,
+ * i.e., when building this component without the rest of FreeType.
+ *
+ */
+
+ /**************************************************************************
+ *
+ * @Function:
+ * FT_Outline_Get_CBox
+ *
+ * @Description:
+ * Return an outline's `control box'. The control box encloses all
+ * the outline's points, including Bézier control points. Though it
+ * coincides with the exact bounding box for most glyphs, it can be
+ * slightly larger in some situations (like when rotating an outline
+ * that contains Bézier outside arcs).
+ *
+ * Computing the control box is very fast, while getting the bounding
+ * box can take much more time as it needs to walk over all segments
+ * and arcs in the outline. To get the latter, you can use the
+ * `ftbbox' component, which is dedicated to this single task.
+ *
+ * @Input:
+ * outline ::
+ * A pointer to the source outline descriptor.
+ *
+ * @Output:
+ * acbox ::
+ * The outline's control box.
+ *
+ * @Note:
+ * See @FT_Glyph_Get_CBox for a discussion of tricky fonts.
+ */
+
+ static void
+ FT_Outline_Get_CBox( const FT_Outline* outline,
+ FT_BBox *acbox )
+ {
+ Long xMin, yMin, xMax, yMax;
+
+
+ if ( outline && acbox )
+ {
+ if ( outline->n_points == 0 )
+ {
+ xMin = 0;
+ yMin = 0;
+ xMax = 0;
+ yMax = 0;
+ }
+ else
+ {
+ FT_Vector* vec = outline->points;
+ FT_Vector* limit = vec + outline->n_points;
+
+
+ xMin = xMax = vec->x;
+ yMin = yMax = vec->y;
+ vec++;
+
+ for ( ; vec < limit; vec++ )
+ {
+ Long x, y;
+
+
+ x = vec->x;
+ if ( x < xMin ) xMin = x;
+ if ( x > xMax ) xMax = x;
+
+ y = vec->y;
+ if ( y < yMin ) yMin = y;
+ if ( y > yMax ) yMax = y;
+ }
+ }
+ acbox->xMin = xMin;
+ acbox->xMax = xMax;
+ acbox->yMin = yMin;
+ acbox->yMax = yMax;
+ }
+ }
+
+#endif /* STANDALONE_ */
+
+
/**************************************************************************
*
* @Function:
@@ -3183,6 +3272,7 @@
{
const FT_Outline* outline = (const FT_Outline*)params->source;
const FT_Bitmap* target_map = params->target;
+ FT_BBox cbox;
black_TWorker worker[1];
@@ -3223,19 +3313,23 @@
if ( !target_map->buffer )
return FT_THROW( Invalid );
+ FT_Outline_Get_CBox( outline, &cbox );
+
/* reject too large outline coordinates */
- {
- FT_Vector* vec = outline->points;
- FT_Vector* limit = vec + outline->n_points;
+ if ( cbox.xMin < -0x1000000L || cbox.xMax > 0x1000000L ||
+ cbox.yMin < -0x1000000L || cbox.yMax > 0x1000000L )
+ return FT_THROW( Invalid );
+ /* truncate the bounding box to integer pixels */
+ cbox.xMin = cbox.xMin >> 6;
+ cbox.yMin = cbox.yMin >> 6;
+ cbox.xMax = ( cbox.xMax + 63 ) >> 6;
+ cbox.yMax = ( cbox.yMax + 63 ) >> 6;
- for ( ; vec < limit; vec++ )
- {
- if ( vec->x < -0x1000000L || vec->x > 0x1000000L ||
- vec->y < -0x1000000L || vec->y > 0x1000000L )
- return FT_THROW( Invalid );
- }
- }
+ /* reject too large glyphs */
+ if ( cbox.xMax - cbox.xMin > 0xFFFF ||
+ cbox.yMax - cbox.yMin > 0xFFFF )
+ return FT_THROW( Invalid );
ras.outline = *outline;
ras.target = *target_map;
diff --git a/src/smooth/ftgrays.c b/src/smooth/ftgrays.c
index 10fdddf..1385380 100644
--- a/src/smooth/ftgrays.c
+++ b/src/smooth/ftgrays.c
@@ -1899,6 +1899,11 @@ typedef ptrdiff_t FT_PtrDist;
cbox.xMax = ( cbox.xMax + 63 ) >> 6;
cbox.yMax = ( cbox.yMax + 63 ) >> 6;
+ /* reject too large glyphs */
+ if ( cbox.xMax - cbox.xMin > 0xFFFF ||
+ cbox.yMax - cbox.yMin > 0xFFFF )
+ return FT_THROW( Invalid_Outline );
+
/* compute clipping box */
if ( !( params->flags & FT_RASTER_FLAG_DIRECT ) )
{