From eef98128fc36ffb5130efffd6c62417f98b0c702 Mon Sep 17 00:00:00 2001
From: jsorg71 <jsorg71>
Date: Sun, 16 Apr 2006 02:20:20 +0000
Subject: [PATCH] bounds check when loading font

---
 xrdp/xrdp_font.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xrdp/xrdp_font.c b/xrdp/xrdp_font.c
index 6cb93930..67bf268a 100644
--- a/xrdp/xrdp_font.c
+++ b/xrdp/xrdp_font.c
@@ -108,6 +108,13 @@ xrdp_font_create(struct xrdp_wm* wm)
         f->incby = i;
         in_uint8s(s, 6);
         datasize = FONT_DATASIZE(f);
+        if (datasize < 0 || datasize > 512)
+        {
+          /* shouldn't happen */
+          g_writeln("error in xrdp_font_create, datasize wrong");
+          g_writeln("%d %d %d", f->width, f->height, datasize);
+          break;
+        }
         if (s_check_rem(s, datasize))
         {
           f->data = (char*)g_malloc(datasize, 0);