[core] Make Image safer

Provide Image::copy, which handles copying rectangles from a source to a destination, with thorough bounds checking.

Also fixes an indexing error in SpriteAtlas, where the top row of pixels in a wrapped image was copied from the wrong source row.

1 files changed, 28 insertions, 18 deletions

diff --git a/src/mbgl/text/glyph_pbf.cpp b/src/mbgl/text/glyph_pbf.cpp
index cdeac57984..5c57d278db 100644
--- a/src/mbgl/text/glyph_pbf.cpp
+++ b/src/mbgl/text/glyph_pbf.cpp
@@ -25,6 +25,7 @@ void parseGlyphPBF(GlyphSet& glyphSet, const GlyphRange& glyphRange, const std::
             auto glyph_pbf = fontstack_pbf.get_message();
 
             SDFGlyph glyph;
+            protozero::data_view glyphData;
 
             bool hasID = false, hasWidth = false, hasHeight = false, hasLeft = false,
                  hasTop = false, hasAdvance = false;
@@ -36,7 +37,7 @@ void parseGlyphPBF(GlyphSet& glyphSet, const GlyphRange& glyphRange, const std::
                     hasID = true;
                     break;
                 case 2: // bitmap
-                    glyph.bitmap = glyph_pbf.get_string();
+                    glyphData = glyph_pbf.get_view();
                     break;
                 case 3: // width
                     glyph.metrics.width = glyph_pbf.get_uint32();
@@ -64,26 +65,35 @@ void parseGlyphPBF(GlyphSet& glyphSet, const GlyphRange& glyphRange, const std::
                 }
             }
 
+            // Only treat this glyph as a correct glyph if it has all required fields. It also
+            // needs to satisfy a few metrics conditions that ensure that the glyph isn't bogus.
+            // All other glyphs are malformed.  We're also discarding all glyphs that are outside
+            // the expected glyph range.
+            if (!hasID || !hasWidth || !hasHeight || !hasLeft || !hasTop || !hasAdvance ||
+                glyph.metrics.width >= 256 || glyph.metrics.height >= 256 ||
+                glyph.metrics.left < -128 || glyph.metrics.left >= 128 ||
+                glyph.metrics.top < -128 || glyph.metrics.top >= 128 ||
+                glyph.metrics.advance >= 256 ||
+                glyph.id < glyphRange.first || glyph.id > glyphRange.second) {
+                continue;
+            }
+
             // If the area of width/height is non-zero, we need to adjust the expected size
             // with the implicit border size, otherwise we expect there to be no bitmap at all.
-            const uint32_t expectedBitmapSize =
-                glyph.metrics.width && glyph.metrics.height
-                    ? (glyph.metrics.width + 2 * SDFGlyph::borderSize) *
-                          (glyph.metrics.height + 2 * SDFGlyph::borderSize)
-                    : 0;
-
-            // Only treat this glyph as a correct glyph if it has all required fields, and if
-            // the bitmap has the correct length. It also needs to satisfy a few metrics conditions
-            // that ensure that the glyph isn't bogus. All other glyphs are malformed.
-            // We're also discarding all glyphs that are outside the expected glyph range.
-            if (hasID && hasWidth && hasHeight && hasLeft && hasTop && hasAdvance &&
-                glyph.metrics.width < 256 && glyph.metrics.height < 256 &&
-                glyph.metrics.left >= -128 && glyph.metrics.left < 128 &&
-                glyph.metrics.top >= -128 && glyph.metrics.top < 128 &&
-                glyph.metrics.advance < 256 && glyph.bitmap.size() == expectedBitmapSize &&
-                glyph.id >= glyphRange.first && glyph.id <= glyphRange.second) {
-                glyphSet.insert(glyph.id, std::move(glyph));
+            if (glyph.metrics.width && glyph.metrics.height) {
+                const Size size {
+                    glyph.metrics.width + 2 * SDFGlyph::borderSize,
+                    glyph.metrics.height + 2 * SDFGlyph::borderSize
+                };
+
+                if (size.area() != glyphData.size()) {
+                    continue;
+                }
+
+                glyph.bitmap = AlphaImage(size, reinterpret_cast<const uint8_t*>(glyphData.data()), glyphData.size());
             }
+
+            glyphSet.insert(glyph.id, std::move(glyph));
         }
     }
 }