[sfnt] Fix Savannah bug #43597.
* src/sfnt/pngshim.c (Load_SBit_Png): Protect against too large
bitmaps.
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 9afbe5a..fdb15d4 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -269,6 +269,13 @@
map->pitch = map->width * 4;
map->num_grays = 256;
+ /* reject too large bitmaps similarly to the rasterizer */
+ if ( map->rows > 0x7FFF || map->width > 0x7FFF )
+ {
+ error = FT_THROW( Array_Too_Large );
+ goto DestroyExit;
+ }
+
size = map->rows * map->pitch;
error = ft_glyphslot_alloc_bitmap( slot, size );