[freetype2] master 983b00e: [sfnt] Fix some signed overflows (#46149).

[Werner LEMBERG]

branch: master
commit 983b00ec8667baf6cd6b23c420d94c681ffd2ec4
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [sfnt] Fix some signed overflows (#46149).
    
    * src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
    <TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
---
 ChangeLog         |    7 +++++++
 src/sfnt/ttsbit.c |   24 +++++++++++++-----------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 8fb955e..066136a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2015-10-08  Werner Lemberg  <address@hidden>
 
+       [sfnt] Fix some signed overflows (#46149).
+
+       * src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
+       <TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
+
+2015-10-08  Werner Lemberg  <address@hidden>
+
        [type1] Protect against invalid number of subroutines (#46150).
 
        * src/type1/t1load.c (parse_subrs): Check number of
diff --git a/src/sfnt/ttsbit.c b/src/sfnt/ttsbit.c
index 3b351ec..8235255 100644
--- a/src/sfnt/ttsbit.c
+++ b/src/sfnt/ttsbit.c
@@ -269,11 +269,11 @@
     case TT_SBIT_TABLE_TYPE_SBIX:
       {
         FT_Stream       stream = face->root.stream;
-        FT_UInt         offset, upem;
-        FT_UShort       ppem, resolution;
+        FT_UInt         offset;
+        FT_UShort       upem, ppem, resolution;
         TT_HoriHeader  *hori;
         FT_ULong        table_size;
-        FT_Pos          ppem_, upem_; /* to reduce casts */
+        FT_Pos          ppem_; /* to reduce casts */
 
         FT_Error  error;
         FT_Byte*  p;
@@ -307,14 +307,16 @@
         metrics->y_ppem = ppem;
 
         ppem_ = (FT_Pos)ppem;
-        upem_ = (FT_Pos)upem;
-
-        metrics->ascender    = ppem_ * hori->Ascender * 64 / upem_;
-        metrics->descender   = ppem_ * hori->Descender * 64 / upem_;
-        metrics->height      = ppem_ * ( hori->Ascender -
-                                         hori->Descender +
-                                         hori->Line_Gap ) * 64 / upem_;
-        metrics->max_advance = ppem_ * hori->advance_Width_Max * 64 / upem_;
+
+        metrics->ascender =
+          FT_MulDiv( hori->Ascender, ppem_ * 64, upem );
+        metrics->descender =
+          FT_MulDiv( hori->Descender, ppem_ * 64, upem );
+        metrics->height =
+          FT_MulDiv( hori->Ascender - hori->Descender + hori->Line_Gap,
+                     ppem_ * 64, upem );
+        metrics->max_advance =
+          FT_MulDiv( hori->advance_Width_Max, ppem_ * 64, upem );
 
         return error;
       }