Skip to content

Commit f8df530

Browse files
authored
Merge pull request #7672 from nulano/imagefont-negative-crop
Trim negative glyph offsets in ImageFont.getmask()
2 parents 24e9485 + 0eb661b commit f8df530

File tree

2 files changed

+11
-1
lines changed

2 files changed

+11
-1
lines changed

Tests/test_imagefontpil.py

+3-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,9 @@ def test_decompression_bomb():
6666

6767
@pytest.mark.timeout(4)
6868
def test_oom():
69-
glyph = struct.pack(">hhhhhhhhhh", 1, 0, 0, 0, 32767, 32767, 0, 0, 32767, 32767)
69+
glyph = struct.pack(
70+
">hhhhhhhhhh", 1, 0, -32767, -32767, 32767, 32767, -32767, -32767, 32767, 32767
71+
)
7072
fp = BytesIO(b"PILfont\n\nDATA\n" + glyph * 256)
7173

7274
font = ImageFont.ImageFont()

src/_imaging.c

+8
Original file line numberDiff line numberDiff line change
@@ -2652,6 +2652,14 @@ _font_new(PyObject *self_, PyObject *args) {
26522652

26532653
// Do not allow glyphs to extend beyond bitmap image
26542654
// Helps prevent DOS by stopping cropped images being larger than the original
2655+
if (self->glyphs[i].sx0 < 0) {
2656+
self->glyphs[i].dx0 -= self->glyphs[i].sx0;
2657+
self->glyphs[i].sx0 = 0;
2658+
}
2659+
if (self->glyphs[i].sy0 < 0) {
2660+
self->glyphs[i].dy0 -= self->glyphs[i].sy0;
2661+
self->glyphs[i].sy0 = 0;
2662+
}
26552663
if (self->glyphs[i].sx1 > self->bitmap->xsize) {
26562664
self->glyphs[i].dx1 -= self->glyphs[i].sx1 - self->bitmap->xsize;
26572665
self->glyphs[i].sx1 = self->bitmap->xsize;

0 commit comments

Comments
 (0)