[core] abort early when placing a glyph in GlyphAtlas if the bitmap is invalid

1 files changed, 12 insertions, 2 deletions

diff --git a/src/mbgl/text/glyph_atlas.cpp b/src/mbgl/text/glyph_atlas.cpp
index 17b3e7e482..dc1fe2b1d9 100644
--- a/src/mbgl/text/glyph_atlas.cpp
+++ b/src/mbgl/text/glyph_atlas.cpp
@@ -117,14 +117,22 @@ Rect<uint16_t> GlyphAtlas::addGlyph(uintptr_t tileUID,
         return value.rect;
     }
 
-    // The glyph bitmap has zero width.
-    if (glyph.bitmap.empty()) {
+    // Guard against glyphs that are too large, or that we don't need to place into the atlas since
+    // they don't have any pixels.
+    if (glyph.metrics.width == 0 || glyph.metrics.width >= 256 ||
+        glyph.metrics.height == 0 || glyph.metrics.height >= 256) {
         return Rect<uint16_t>{ 0, 0, 0, 0 };
     }
 
     uint16_t buffered_width = glyph.metrics.width + SDFGlyph::borderSize * 2;
     uint16_t buffered_height = glyph.metrics.height + SDFGlyph::borderSize * 2;
 
+    // Guard against mismatches between the glyph bitmap size and the size mandated by
+    // its metrics.
+    if (size_t(buffered_width * buffered_height) != glyph.bitmap.size()) {
+        return Rect<uint16_t>{ 0, 0, 0, 0 };
+    }
+
     // Add a 1px border around every image.
     const uint16_t padding = 1;
     uint16_t pack_width = buffered_width + 2 * padding;
@@ -142,6 +150,8 @@ Rect<uint16_t> GlyphAtlas::addGlyph(uintptr_t tileUID,
         return rect;
     }
 
+    // Verify that binpack didn't produce a rect that goes beyond the size of the image.
+    // This should never happen.
     assert(rect.x + rect.w <= image.size.width);
     assert(rect.y + rect.h <= image.size.height);