From b38da2cfa7b2879d3d8521dc95211b6e1d5d4dcd Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jfkthame@gmail.com>
Date: Wed, 15 Apr 2026 17:51:25 +0100
Subject: [PATCH] Fix tt_face_colr_blend_layer for FT_PIXEL_MODE_MONO source.

---
 src/sfnt/ttcolr.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c
index b22e279b3..57a71a614 100644
--- a/src/sfnt/ttcolr.c
+++ b/src/sfnt/ttcolr.c
@@ -1862,7 +1862,11 @@
       alpha = face->palette[color_index].alpha;
     }
 
-    /* XXX Convert if srcSlot.bitmap is not grey? */
+    /* Reject pixel modes other than GRAY/MONO. */
+    if ( srcSlot->bitmap.pixel_mode != FT_PIXEL_MODE_GRAY &&
+         srcSlot->bitmap.pixel_mode != FT_PIXEL_MODE_MONO )
+      return FT_Err_Invalid_Glyph_Format;
+
     src = srcSlot->bitmap.buffer;
     dst = dstSlot->bitmap.buffer +
           dstSlot->bitmap.pitch * ( dstSlot->bitmap_top - srcSlot->bitmap_top ) +
@@ -1872,7 +1876,9 @@
     {
       for ( x = 0; x < srcSlot->bitmap.width; x++ )
       {
-        int  aa = src[x];
+        int  aa = srcSlot->bitmap.pixel_mode == FT_PIXEL_MODE_MONO
+                    ? ( src[x >> 3] & ( 0x80 >> ( x & 7 ) ) ) ? 255 : 0
+                    : src[x];
         int  fa = alpha * aa / 255;
 
         int  fb = b * fa / 255;