[freetype2] smooth_malloc d10165279 3/3: * src/smooth/ftgrays.c (gray_convert_glyph): Limit complexity.

[Werner Lemberg]

branch: smooth_malloc
commit d101652791a491feb19e9c9bd5dc3f8074dac3cc
Author: Alexei Podtelezhnikov <apodtele@gmail.com>
Commit: Alexei Podtelezhnikov <apodtele@gmail.com>

    * src/smooth/ftgrays.c (gray_convert_glyph): Limit complexity.
---
 src/smooth/ftgrays.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/smooth/ftgrays.c b/src/smooth/ftgrays.c
index f56cf1c4a..38a92613a 100644
--- a/src/smooth/ftgrays.c
+++ b/src/smooth/ftgrays.c
@@ -2011,9 +2011,16 @@ typedef ptrdiff_t  FT_PtrDist;
     int  continued = 0;
 
 
-    size = gray_taxi( RAS_VAR ) +
-           height * sizeof ( PCell ) / sizeof ( TCell ) +
-           9;  /* empirical extra for local extrema */
+    size = gray_taxi( RAS_VAR );
+
+    /* taxicab perimeters in excess of 20 CBox perimeters are    */
+    /* not rendered unless in direct mode with possible clipping */
+    if ( !ras.render_span                                     &&
+         size > 20 * 2 * ( ras.max_ex - ras.min_ex + height ) )
+      return FT_THROW( Invalid_Outline );
+
+    size += height * sizeof ( PCell ) / sizeof ( TCell ) +
+            9;  /* empirical extra for local extrema */
 
     if ( FT_QNEW_ARRAY( buffer, size ) )
       return error;