diff options
Diffstat (limited to 'render')
| -rw-r--r-- | render/render.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/render/render.c b/render/render.c index f03f54a2b..16b8eb3c3 100644 --- a/render/render.c +++ b/render/render.c @@ -1117,9 +1117,16 @@ ProcRenderAddGlyphs (ClientPtr client) remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs; for (i = 0; i < nglyphs; i++) { + size_t padded_width; glyph_new = &glyphs[i]; - size = gi[i].height * PixmapBytePad (gi[i].width, - glyphSet->format->depth); + + padded_width = PixmapBytePad (gi[i].width, + glyphSet->format->depth); + + if (gi[i].height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi[i].height) + break; + + size = gi[i].height * padded_width; if (remain < size) break; |