Check vector clip mask bounding box size

Similar to regular glyphs, check the bounding box of the clip mask and
refrain from rendering humongous masks, which can take up considerably
memory.

diff --git a/libass/ass_bitmap.c b/libass/ass_bitmap.c
index 93f2aa8e9e785ae5c071b653de07f2abd51b019b..9211a7c0080d80a2928c96dd6c2e47e10ed76831 100644 (file)
--- a/libass/ass_bitmap.c
+++ b/libass/ass_bitmap.c
@@ -165,7 +165,7 @@ static Bitmap *copy_bitmap(const Bitmap *src)
     return dst;
 }
 
-static int check_glyph_area(ASS_Library *library, FT_Glyph glyph)
+int check_glyph_area(ASS_Library *library, FT_Glyph glyph)
 {
     FT_BBox bbox;
     long long dx, dy;

diff --git a/libass/ass_bitmap.h b/libass/ass_bitmap.h
index 338db011937871e65795a45c296eeff011b0f323..7a61118890b0d68c80e6a1423ce9f58b8ee1064a 100644 (file)
--- a/libass/ass_bitmap.h
+++ b/libass/ass_bitmap.h
@@ -53,5 +53,6 @@ int glyph_to_bitmap(ASS_Library *library, ASS_SynthPriv *priv_blur,
                     int border_style);
 
 void ass_free_bitmap(Bitmap *bm);
+int check_glyph_area(ASS_Library *library, FT_Glyph glyph);
 
 #endif                          /* LIBASS_BITMAP_H */

diff --git a/libass/ass_render.c b/libass/ass_render.c
index 663afe17afbd6b529b7bba9814f9607956fac1ac..3e241c11e2602932bd77f39ee095fe903bc6dff3 100644 (file)
--- a/libass/ass_render.c
+++ b/libass/ass_render.c
@@ -595,7 +595,7 @@ static void blend_vector_clip(ASS_Renderer *render_priv,
         if (!glyph) {
             ass_msg(render_priv->library, MSGL_WARN,
                     "Clip vector parsing failed. Skipping.");
-            goto blend_vector_exit;
+            goto blend_vector_error;
         }
 
         // We need to translate the clip according to screen borders
@@ -609,6 +609,13 @@ static void blend_vector_clip(ASS_Renderer *render_priv,
                                  trans.x, trans.y);
         }
 
+        // Check glyph bounding box size
+        if (check_glyph_area(render_priv->library, glyph)) {
+            FT_Done_Glyph(glyph);
+            glyph = 0;
+            goto blend_vector_error;
+        }
+
         ass_msg(render_priv->library, MSGL_DBG2,
                 "Parsed vector clip: scales (%f, %f) string [%s]\n",
                 drawing->scale_x, drawing->scale_y, drawing->text);
@@ -618,10 +625,11 @@ static void blend_vector_clip(ASS_Renderer *render_priv,
             ass_msg(render_priv->library, MSGL_WARN,
                 "Clip vector rasterization failed: %d. Skipping.", error);
             FT_Done_Glyph(glyph);
-            goto blend_vector_exit;
+            glyph = 0;
         }
+
+blend_vector_error:
         clip_bm = (FT_BitmapGlyph) glyph;
-        clip_bm->top = -clip_bm->top;
 
         // Add to cache
         memset(&v, 0, sizeof(v));
@@ -629,7 +637,7 @@ static void blend_vector_clip(ASS_Renderer *render_priv,
         cache_add_glyph(render_priv->cache.glyph_cache, &key, &v);
     }
 
-    assert(clip_bm->bitmap.pitch >= 0);
+    if (!clip_bm) goto blend_vector_exit;
 
     // Iterate through bitmaps and blend/clip them
     for (cur = head; cur; cur = cur->next) {
@@ -647,7 +655,7 @@ static void blend_vector_clip(ASS_Renderer *render_priv,
         ah = cur->h;
         as = cur->stride;
         bx = clip_bm->left;
-        by = clip_bm->top;
+        by = -clip_bm->top;
         bw = clip_bm->bitmap.width;
         bh = clip_bm->bitmap.rows;
         bs = clip_bm->bitmap.pitch;