Skip to content

Commit

Permalink
Merge pull request #7672 from nulano/imagefont-negative-crop
Browse files Browse the repository at this point in the history
Trim negative glyph offsets in ImageFont.getmask()
  • Loading branch information
radarhere authored Jan 1, 2024
2 parents 24e9485 + 0eb661b commit f8df530
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 1 deletion.
4 changes: 3 additions & 1 deletion Tests/test_imagefontpil.py
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,9 @@ def test_decompression_bomb():

@pytest.mark.timeout(4)
def test_oom():
glyph = struct.pack(">hhhhhhhhhh", 1, 0, 0, 0, 32767, 32767, 0, 0, 32767, 32767)
glyph = struct.pack(
">hhhhhhhhhh", 1, 0, -32767, -32767, 32767, 32767, -32767, -32767, 32767, 32767
)
fp = BytesIO(b"PILfont\n\nDATA\n" + glyph * 256)

font = ImageFont.ImageFont()
Expand Down
8 changes: 8 additions & 0 deletions src/_imaging.c
Original file line number Diff line number Diff line change
Expand Up @@ -2652,6 +2652,14 @@ _font_new(PyObject *self_, PyObject *args) {

// Do not allow glyphs to extend beyond bitmap image
// Helps prevent DOS by stopping cropped images being larger than the original
if (self->glyphs[i].sx0 < 0) {
self->glyphs[i].dx0 -= self->glyphs[i].sx0;
self->glyphs[i].sx0 = 0;
}
if (self->glyphs[i].sy0 < 0) {
self->glyphs[i].dy0 -= self->glyphs[i].sy0;
self->glyphs[i].sy0 = 0;
}
if (self->glyphs[i].sx1 > self->bitmap->xsize) {
self->glyphs[i].dx1 -= self->glyphs[i].sx1 - self->bitmap->xsize;
self->glyphs[i].sx1 = self->bitmap->xsize;
Expand Down

0 comments on commit f8df530

Please sign in to comment.