Skip to content

drcs: reject attempts to write a glyph that is too tall - #20409

Merged
Dustin L. Howett (DHowett) merged 1 commit into
mainfrom
dev/duhowett/drcs-
Jul 10, 2026
Merged

drcs: reject attempts to write a glyph that is too tall#20409
Dustin L. Howett (DHowett) merged 1 commit into
mainfrom
dev/duhowett/drcs-

Conversation

@DHowett

Copy link
Copy Markdown
Member

We probably shouldn't walk this iterator off the end of the array. Or write into it.

@DHowett

Copy link
Copy Markdown
Member Author

/cc James Holderness (@j4james) I think this is safe enough for existing DRCS fonts.

(This is similar to the Sixel OOB write, triggered by a DRCS payload with a couple hundred million \ next line characters.)

@DHowett
Dustin L. Howett (DHowett) enabled auto-merge (squash) July 10, 2026 21:32
@DHowett
Dustin L. Howett (DHowett) merged commit dd494ac into main Jul 10, 2026
18 of 20 checks passed
@DHowett
Dustin L. Howett (DHowett) deleted the dev/duhowett/drcs- branch July 10, 2026 21:35
@DHowett Dustin L. Howett (DHowett) moved this from To Cherry Pick to Cherry Picked in 1.24 Servicing Pipeline Jul 10, 2026
@DHowett Dustin L. Howett (DHowett) moved this from To Cherry Pick to Cherry Picked in 1.25 Servicing Pipeline Jul 10, 2026
Dustin L. Howett (DHowett) added a commit that referenced this pull request Jul 10, 2026
We probably shouldn't walk this iterator off the end of the array. Or
write into it.

(cherry picked from commit dd494ac)
Service-Card-Id: PVTI_lADOAF3p4s4BBcTlzgycxr4
Service-Version: 1.24
Dustin L. Howett (DHowett) added a commit that referenced this pull request Jul 10, 2026
We probably shouldn't walk this iterator off the end of the array. Or
write into it.

(cherry picked from commit dd494ac)
Service-Card-Id: PVTI_lADOAF3p4s4BQX0-zgycxrs
Service-Version: 1.25
@j4james

Copy link
Copy Markdown
Collaborator

Sorry about the bug. I think the fix is probably fine. You do get fonts that'll have some rows that are out of range, and ideally we should just be ignoring that rather than aborting the whole font, but if we're only going to hit the limit at MAX_HEIGHT, it's unlikely to be an issue in practice.

@DHowett

Copy link
Copy Markdown
Member Author

np, thank you for looking!

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the o
Pixel is moving to many times after the entry try one + not ++.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Cherry Picked

Development

Successfully merging this pull request may close these issues.

4 participants