[freetype2] master 0ad3262: * src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.

[Werner LEMBERG]

branch: master
commit 0ad326236607df0802dc72c4f13b3f35484b7672
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    * src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
---
 ChangeLog          |  4 ++++
 src/base/ftglyph.c | 13 +++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index 57753f2..35b18c1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 2017-06-01  Werner Lemberg  <address@hidden>
 
+       * src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
+
+2017-06-01  Werner Lemberg  <address@hidden>
+
        [psaux] 32bit integer overflow tun-time errors (#46149).
 
        * src/psaux/t1decode.c (t1_decoder_parse_charstrings): Use
diff --git a/src/base/ftglyph.c b/src/base/ftglyph.c
index 9bfb330..62d94cb 100644
--- a/src/base/ftglyph.c
+++ b/src/base/ftglyph.c
@@ -408,6 +408,19 @@
       goto Exit;
 
     /* copy advance while converting 26.6 to 16.16 format */
+    if ( slot->advance.x >=  0x8000L * 64 ||
+         slot->advance.x <= -0x8000L * 64 )
+    {
+      FT_ERROR(( "FT_Get_Glyph: advance width too large\n" ));
+      return FT_THROW( Invalid_Argument );
+    }
+    if ( slot->advance.y >=  0x8000L * 64 ||
+         slot->advance.y <= -0x8000L * 64 )
+    {
+      FT_ERROR(( "FT_Get_Glyph: advance height too large\n" ));
+      return FT_THROW( Invalid_Argument );
+    }
+
     glyph->advance.x = slot->advance.x * 1024;
     glyph->advance.y = slot->advance.y * 1024;