Check overflow of outline points in ft_stroke_border_export()

Samsung · Mar 5, 2022 · a4fde1c · a4fde1c
1 parent f7b72f1
commit a4fde1c
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/vector/freetype/v_ft_stroker.cpp b/src/vector/freetype/v_ft_stroker.cpp
@@ -18,6 +18,7 @@
 
 #include "v_ft_stroker.h"
 #include <assert.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 #include "v_ft_math.h"
@@ -626,6 +627,8 @@ static SW_FT_Error ft_stroke_border_get_counts(SW_FT_StrokeBorder border,
 static void ft_stroke_border_export(SW_FT_StrokeBorder border,
                                     SW_FT_Outline*     outline)
 {
+    if ((ulong)outline->n_points + border->num_points > SHRT_MAX) return;
+
     /* copy point locations */
     memcpy(outline->points + outline->n_points, border->points,
            border->num_points * sizeof(SW_FT_Vector));