From 4cd078071e2487f052ec997ee13bb910d796587b Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Mon, 12 Jan 2026 22:45:16 +0100
Subject: [PATCH] Fix CVE-2025-15279: Move bounds check inside cnt >= 3 block
 (#5723)

From: Ahmet Furkan Kavraz <55850855+ahmetfurkankavraz@users.noreply.github.com>

Co-authored-by: Ahmet Furkan Kavraz <kavraz@amazon.com>

CVE: CVE-2025-15279
Upstream-Status: Backport [https://github.com/fontforge/fontforge/commit/720ea95020c964202928afd2e93b0f5fac11027e]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 gutils/gimagereadbmp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gutils/gimagereadbmp.c b/gutils/gimagereadbmp.c
index 133336787..ad365158c 100644
--- a/gutils/gimagereadbmp.c
+++ b/gutils/gimagereadbmp.c
@@ -190,10 +190,10 @@ static int readpixels(FILE *file,struct bmpheader *head) {
 		    head->byte_pixels[ii++] = ch;
 	    } else {
 		cnt = getc(file);
-		if (cnt < 0 || ii + cnt > head->height * head->width) {
-		    return 0;
-		}
 		if ( cnt>= 3 ) {
+		    if (ii + cnt > head->height * head->width) {
+			return 0;
+		    }
 		    int odd = cnt&1;
 		    while ( --cnt>=0 )
 			head->byte_pixels[ii++] = getc(file);
