vtfontcvt: improve .bdf verification
Previously we would crash if the BBX y-offset was outside of the font bounding box. Reported by: afl MFC with: r349100 Event: Berlin Devsummit 2019 Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
c6e475ff5a
commit
fd0e3f7c98
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=349107
@ -383,7 +383,8 @@ parse_bdf(FILE *fp, unsigned int map_idx)
|
|||||||
sscanf(ln + 4, "%d %d %d %d", &bbw, &bbh, &bbox,
|
sscanf(ln + 4, "%d %d %d %d", &bbw, &bbh, &bbox,
|
||||||
&bboy) == 4) {
|
&bboy) == 4) {
|
||||||
if (bbw < 1 || bbh < 1 || bbw > fbbw || bbh > fbbh ||
|
if (bbw < 1 || bbh < 1 || bbw > fbbw || bbh > fbbh ||
|
||||||
bbox < fbbox || bboy < fbboy)
|
bbox < fbbox || bboy < fbboy ||
|
||||||
|
bbh + bboy > fbbh + fbboy)
|
||||||
errx(1, "broken bitmap with BBX %d %d %d %d at line %u",
|
errx(1, "broken bitmap with BBX %d %d %d %d at line %u",
|
||||||
bbw, bbh, bbox, bboy, linenum);
|
bbw, bbh, bbox, bboy, linenum);
|
||||||
bbwbytes = howmany(bbw, 8);
|
bbwbytes = howmany(bbw, 8);
|
||||||
|
Loading…
Reference in New Issue
Block a user