From ea2892c30e6be7f073d2fc70237b7f6a77efff82 Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Mon, 26 Dec 2022 10:10:39 -0500
Subject: [PATCH] [paint] Limit the size of the graph we follow

In addition to checking the depth, also count
the number of edges in the graph we've followed,
and give up after 1024.
---
 src/hb-ot-color-colr-table.hh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/hb-ot-color-colr-table.hh b/src/hb-ot-color-colr-table.hh
index 6af8cad13..b132da0e1 100644
--- a/src/hb-ot-color-colr-table.hh
+++ b/src/hb-ot-color-colr-table.hh
@@ -45,6 +45,10 @@
 #define HB_COLRV1_MAX_NESTING_LEVEL	128
 #endif
 
+#ifndef HB_COLRV1_MAX_EDGE_COUNT
+#define HB_COLRV1_MAX_EDGE_COUNT	1024
+#endif
+
 
 namespace OT {
 struct hb_paint_context_t;
@@ -75,6 +79,7 @@ public:
   hb_color_t foreground;
   VarStoreInstancer &instancer;
   int depth_left = HB_COLRV1_MAX_NESTING_LEVEL;
+  int edge_count = HB_COLRV1_MAX_EDGE_COUNT;
 
   hb_paint_context_t (const void *base_,
 		      hb_paint_funcs_t *funcs_,
@@ -2151,7 +2156,8 @@ void
 hb_paint_context_t::recurse (const Paint &paint)
 {
   depth_left--;
-  if (depth_left > 0)
+  edge_count--;
+  if (depth_left > 0 && edge_count > 0)
     paint.dispatch (this);
   depth_left++;
 }