diff --git a/src/base/ftstroke.c b/src/base/ftstroke.c index 5399efe..8978d72 100644 --- a/src/base/ftstroke.c +++ b/src/base/ftstroke.c @@ -701,6 +701,8 @@ ft_stroke_border_export( FT_StrokeBorder border, FT_Outline* outline ) { + if (outline->n_points < 0) + return; /* copy point locations */ FT_ARRAY_COPY( outline->points + outline->n_points, border->points, @@ -743,6 +745,10 @@ } outline->n_points = (short)( outline->n_points + border->num_points ); + /* Check for overflow - int's won't fit in a short. */ + if (outline->n_points != outline->n_points + border->num_points) { + outline->n_points = -1; + } FT_ASSERT( FT_Outline_Check( outline ) == 0 ); } @@ -2307,6 +2313,13 @@ outline->n_contours = 0; FT_Stroker_Export( stroker, outline ); + + /* Check to see if the outline has overflowed */ + if (outline->n_points < 0) { + FT_Outline_Done( glyph->library, outline ); + error = FT_Err_Array_Too_Large; + goto Fail; + } } if ( destroy ) @@ -2396,6 +2409,13 @@ outline->n_contours = 0; FT_Stroker_ExportBorder( stroker, border, outline ); + + /* Check to see if the outline has overflowed */ + if (outline->n_points < 0) { + FT_Outline_Done( glyph->library, outline ); + error = FT_Err_Array_Too_Large; + goto Fail; + } } if ( destroy )