font/plan9font: limit the font image's dimensions
Fixes golang/go#57258
Change-Id: I0249e422470219594188d050ebd6dc42f1646dff
Reviewed-on: https://go-review.googlesource.com/c/image/+/458095
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Nigel Tao (INACTIVE; USE @golang.org INSTEAD) <nigeltao@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Nigel Tao <nigeltao@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
diff --git a/font/plan9font/plan9font.go b/font/plan9font/plan9font.go
index cee8039..858b0f6 100644
--- a/font/plan9font/plan9font.go
+++ b/font/plan9font/plan9font.go
@@ -465,6 +465,11 @@
}
width := bytesPerLine(r, depth)
+ // These bounds are somewhat arbitrary, but multiplying them together won't
+ // overflow an int32.
+ if (width > 0xffff) || (r.Dy() > 0x7fff) {
+ return nil, nil, errors.New("plan9font: unsupported dimensions")
+ }
m = &plan9Image{
depth: depth,
width: width,
