From 0e3aeb782da0737c8c591da409bdaba6e26dacdf Mon Sep 17 00:00:00 2001
From: Patrick Walton <pcwalton@mimiga.net>
Date: Tue, 7 Feb 2017 16:53:37 -0800
Subject: [PATCH] Fix a couple of integer overflows

---
 src/otf/glyf.rs    | 6 ++++++
 src/otf/mod.rs     | 3 ++-
 src/rect_packer.rs | 5 +++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/otf/glyf.rs b/src/otf/glyf.rs
index 0b564b69..4366e50d 100644
--- a/src/otf/glyf.rs
+++ b/src/otf/glyf.rs
@@ -92,7 +92,13 @@ impl<'a> GlyfTable<'a> {
 
     fn for_each_point_in_simple_glyph<F>(&self, mut reader: &[u8], mut callback: F)
                                          -> Result<(), Error> where F: FnMut(&Point) {
+        // Determine how many contours we have.
         let number_of_contours = try!(reader.read_i16::<BigEndian>().map_err(Error::eof));
+        if number_of_contours == 0 {
+            return Ok(())
+        }
+
+        // Skip over the rest of the header.
         try!(reader.jump(mem::size_of::<i16>() * 4).map_err(Error::eof));
 
         // Find out how many points we have.
diff --git a/src/otf/mod.rs b/src/otf/mod.rs
index 05d3b09f..b2828159 100644
--- a/src/otf/mod.rs
+++ b/src/otf/mod.rs
@@ -297,12 +297,13 @@ impl<'a> Font<'a> {
 
     #[inline]
     pub fn shelf_height(&self, point_size: f32) -> u32 {
+        // Add 2 to account for the border.
         self.head
             .max_glyph_bounds
             .pixel_rect_f(self.head.units_per_em, point_size)
             .to_i()
             .size()
-            .height as u32
+            .height as u32 + 2
     }
 
     #[inline]
diff --git a/src/rect_packer.rs b/src/rect_packer.rs
index 8bdc7546..0c354bee 100644
--- a/src/rect_packer.rs
+++ b/src/rect_packer.rs
@@ -38,6 +38,11 @@ impl RectPacker {
         // Add a one-pixel border to prevent bleed.
         let alloc_size = *size + Size2D::new(2, 2);
 
+        // If the allocation size is less than our shelf height, we will always fail.
+        if alloc_size.height > self.shelf_height {
+            return Err(())
+        }
+
         let chosen_index_and_rect =
             self.free_rects
                 .iter()