Description: Verify array length before writing in Freetype
 An attempt to fix CVE-2021-31321 based on John Preston's commit.
 https://github.com/desktop-app/rlottie/commit/d369d84e868352886cee48eecb60b462f6dfe067
Author: Nicholas Guriev <guriev-ns@ya.ru>
Last-Update: Sat, 22 May 2021 19:07:06 +0300

--- a/src/vector/freetype/v_ft_raster.cpp
+++ b/src/vector/freetype/v_ft_raster.cpp
@@ -67,6 +67,17 @@
     }                   \
     while (0)
 
+#include <iterator>
+#if 201103L <= __cplusplus && __cplusplus < 201703L
+namespace std {
+
+// Taken from https://stackoverflow.com/a/18078435/5000805
+template<class T, size_t N>
+constexpr size_t size(T (&)[N]) { return N; }
+
+}
+#endif
+
 #include <limits.h>
 #include <setjmp.h>
 #include <stddef.h>
@@ -707,6 +718,9 @@ static void gray_render_conic(RAS_ARG_ c
             gray_split_conic(arc);
             arc += 2;
             top++;
+
+            if (top >= static_cast<int>(std::size(ras.lev_stack))) return;
+
             levels[top] = levels[top - 1] = level - 1;
             continue;
         }
@@ -835,6 +849,9 @@ static void gray_render_cubic(RAS_ARG_ c
     Split:
         gray_split_cubic(arc);
         arc += 3;
+
+        if (arc + 4 > std::end(ras.bez_stack)) return;
+
         continue;
 
     Draw:
@@ -1378,7 +1395,9 @@ static int gray_raster_render(gray_PRast
     SW_FT_UNUSED(raster);
     const SW_FT_Outline* outline = (const SW_FT_Outline*)params->source;
 
+#ifndef SW_FT_STATIC_RASTER
     gray_TWorker worker[1];
+#endif
 
     TCell buffer[SW_FT_RENDER_POOL_SIZE / sizeof(TCell)];
     long  buffer_size = sizeof(buffer);