Skip to content

Commit 62e803b

Browse files
committed
[sbix] Limit glyph extents
Fixes #3557
1 parent cd05d18 commit 62e803b

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

Diff for: src/hb-ot-color-sbix-table.hh

+6
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,12 @@ struct sbix
298298

299299
const PNGHeader &png = *blob->as<PNGHeader>();
300300

301+
if (png.IHDR.height >= 65536 | png.IHDR.width >= 65536)
302+
{
303+
hb_blob_destroy (blob);
304+
return false;
305+
}
306+
301307
extents->x_bearing = x_offset;
302308
extents->y_bearing = png.IHDR.height + y_offset;
303309
extents->width = png.IHDR.width;

Diff for: test/fuzzing/fonts/sbix-extents.ttf

582 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)