[xsrc/netbsd-8]: xsrc/external/mit/freetype/dist/src/sfnt Apply patch, reques...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/e740c311560c
branches:  netbsd-8
changeset: 10586:e740c311560c
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Oct 22 11:31:16 2020 +0000

description:
Apply patch, requested by maya and mrg in ticket #1618:

        xsrc/external/mit/freetype/dist/src/sfnt/pngshim.c      (apply patch)

Fix for CVE-2020-15999.

diffstat:

 external/mit/freetype/dist/src/sfnt/pngshim.c |  13 ++++++-------
 1 files changed, 6 insertions(+), 7 deletions(-)

diffs (30 lines):

diff -r 7d98ab160b87 -r e740c311560c external/mit/freetype/dist/src/sfnt/pngshim.c
--- a/external/mit/freetype/dist/src/sfnt/pngshim.c     Wed Aug 05 14:10:13 2020 +0000
+++ b/external/mit/freetype/dist/src/sfnt/pngshim.c     Thu Oct 22 11:31:16 2020 +0000
@@ -260,6 +260,12 @@
     {
       FT_ULong  size;
 
+      /* reject too large bitmaps similarly to the rasterizer */
+      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto DestroyExit;
+      }
 
       metrics->width  = (FT_UShort)imgWidth;
       metrics->height = (FT_UShort)imgHeight;
@@ -270,13 +276,6 @@
       map->pitch      = (int)( map->width * 4 );
       map->num_grays  = 256;
 
-      /* reject too large bitmaps similarly to the rasterizer */
-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
-      {
-        error = FT_THROW( Array_Too_Large );
-        goto DestroyExit;
-      }
-
       /* this doesn't overflow: 0x7FFF * 0x7FFF * 4 < 2^32 */
       size = map->rows * (FT_ULong)map->pitch;