font/plan9font: limit the font image's dimensions

Fixes golang/go#57258

Change-Id: I0249e422470219594188d050ebd6dc42f1646dff
Reviewed-on: https://go-review.googlesource.com/c/image/+/458095
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Nigel Tao (INACTIVE; USE @golang.org INSTEAD) <nigeltao@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Nigel Tao <nigeltao@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

 font/plan9font/plan9font.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/font/plan9font/plan9font.go b/font/plan9font/plan9font.go
index cee8039..858b0f6 100644
--- a/font/plan9font/plan9font.go
+++ b/font/plan9font/plan9font.go
@@ -465,6 +465,11 @@ func parseImage(data []byte) (remainingData []byte, m *plan9Image, retErr error)
 	}
 
 	width := bytesPerLine(r, depth)
+	// These bounds are somewhat arbitrary, but multiplying them together won't
+	// overflow an int32.
+	if (width > 0xffff) || (r.Dy() > 0x7fff) {
+		return nil, nil, errors.New("plan9font: unsupported dimensions")
+	}
 	m = &plan9Image{
 		depth: depth,
 		width: width,