commit fa3b7c5efed0de94151c0f8624e1815ec72d27a9
author Seigo Nonaka <nona@google.com> Wed Nov 11 02:38:41 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed Nov 11 02:38:41 2020 +0000
tree 79fad10ef522c25c9a4df324f1c8e5d813854099
parent 59361603b6e47b5256cd8926123dfa21d2b1bd09
parent 573e921c6d0859fb2dcd4000894b1e69ae685593

Cherry-pick one upstream patch am: 573e921c6d

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/freetype/+/12903058

Change-Id: I0427e517247f6e31a2671c24ef8adaede1cdab4a

src/sfnt/pngshim.c

diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index 96fc08e..319b15d 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -259,6 +259,13 @@
 
     if ( populate_map_and_metrics )
     {
+      /* reject too large bitmaps similarly to the rasterizer */
+      if ( imgHeight > 0x7FFF || imgWidth > 0x7FFF )
+      {
+        error = FT_THROW( Array_Too_Large );
+        goto DestroyExit;
+      }
+
       metrics->width  = (FT_UShort)imgWidth;
       metrics->height = (FT_UShort)imgHeight;
 
@@ -267,13 +274,6 @@
       map->pixel_mode = FT_PIXEL_MODE_BGRA;
       map->pitch      = (int)( map->width * 4 );
       map->num_grays  = 256;
-
-      /* reject too large bitmaps similarly to the rasterizer */
-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )
-      {
-        error = FT_THROW( Array_Too_Large );
-        goto DestroyExit;
-      }
     }
 
     /* convert palette/gray image to rgb */