From 91a6cf7e67033b9bdb2778d4dcb65d65ef30695f Mon Sep 17 00:00:00 2001
From: kichikuou <KichikuouChrome@gmail.com>
Date: Sun, 30 Aug 2020 09:58:09 +0900
Subject: [PATCH] Fix out-of-bounds memory access in font_ttf_get_glyph

FT_GlyphSlot.bitmap_left can be negative.
---
 src/font_freetype2.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/font_freetype2.c b/src/font_freetype2.c
index 8dd43cf..f248679 100644
--- a/src/font_freetype2.c
+++ b/src/font_freetype2.c
@@ -141,11 +141,15 @@ static void font_ttf_sel_font(int type, int size) {
 }
 
 static void pixmap2comimg(BYTE *src, int x, int y, int w, int h, int src_bpl) {
-	int yy;
+	if (x < 0) {
+		w += x;
+		src -= x;
+		x = 0;
+	}
 	BYTE *dst = GETOFFSET_PIXEL(&img_glyph, x, y);
 	if (w <= 0) return;
 	
-	for (yy = 0; yy < h; yy++) {
+	for (int yy = 0; yy < h; yy++) {
 		memcpy(dst, src, w);
 		src += src_bpl;
 		dst += img_glyph.bytes_per_line;