Index: src/base/ftbitmap.c |
diff --git a/src/base/ftbitmap.c b/src/base/ftbitmap.c |
index 22ec337526acb5ebdbf2216c3e828ef673b35aff..84fa3227537a9922846a63811d02269d1b1f1481 100644 |
--- a/src/base/ftbitmap.c |
+++ b/src/base/ftbitmap.c |
@@ -4,7 +4,7 @@ |
/* */ |
/* FreeType utility functions for bitmaps (body). */ |
/* */ |
-/* Copyright 2004, 2005, 2006, 2007, 2008, 2009 by */ |
+/* Copyright 2004-2009, 2011 by */ |
/* David Turner, Robert Wilhelm, and Werner Lemberg. */ |
/* */ |
/* This file is part of the FreeType project, and may only be used, */ |
@@ -231,7 +231,7 @@ |
if ( ( ( FT_PIX_ROUND( xStrength ) >> 6 ) > FT_INT_MAX ) || |
( ( FT_PIX_ROUND( yStrength ) >> 6 ) > FT_INT_MAX ) ) |
return FT_Err_Invalid_Argument; |
- |
+ |
xstr = (FT_Int)FT_PIX_ROUND( xStrength ) >> 6; |
ystr = (FT_Int)FT_PIX_ROUND( yStrength ) >> 6; |
@@ -417,6 +417,10 @@ |
target->pitch = source->width + pad; |
+ if ( target->pitch > 0 && |
+ (FT_ULong)target->rows > FT_ULONG_MAX / target->pitch ) |
+ return FT_Err_Invalid_Argument; |
+ |
if ( target->rows * target->pitch > old_size && |
FT_QREALLOC( target->buffer, |
old_size, target->rows * target->pitch ) ) |