bdfReadCharacters: ensure metrics fit into xCharInfo struct [CVE-2015-1804]

We use 32-bit ints to read from the bdf file, but then try to stick
into a 16-bit int in the xCharInfo struct, so make sure they won't
overflow that range.

Found by afl-1.24b.

v2: Verify that additions won't overflow 32-bit int range either.
v3: As Julien correctly observes, the previous check for bh & bw not
    being < 0 reduces the number of cases we need to check for overflow.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>

0 files changed, 0 insertions, 0 deletions