[freetype2] master 7bffeac: [cff, truetype] Integer overflows.

[Werner LEMBERG]

branch: master
commit 7bffeacd7ef77d050e8bcbbc4e4ab761fa7861b9
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [cff, truetype] Integer overflows.
    
    Reported as
    
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
      https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137
    
    * src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.
    
    * src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
    OVERFLOW_SUB_LONG.
---
 ChangeLog               | 16 +++++++++++++++-
 src/cff/cf2hints.c      |  2 +-
 src/truetype/ttinterp.c | 14 +++++++++-----
 3 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 8d4e316..0c57dc7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,20 @@
+2017-06-07  Werner Lemberg  <address@hidden>
+
+       [cff, truetype] Integer overflows.
+
+       Reported as
+
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
+         https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137
+
+       * src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.
+
+       * src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
+       OVERFLOW_SUB_LONG.
+
 2017-06-06  Werner Lemberg  <address@hidden>
 
-       [cff] Integer overflow.
+       [cff] Integer overflows.
 
        Reported as
 
diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c
index e326c1b..634b280 100644
--- a/src/cff/cf2hints.c
+++ b/src/cff/cf2hints.c
@@ -105,7 +105,7 @@
                                          stemHintArray,
                                          indexStemHint );
 
-    width = stemHint->max - stemHint->min;
+    width = OVERFLOW_SUB_INT32( stemHint->max, stemHint->min );
 
     if ( width == cf2_intToFixed( -21 ) )
     {
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index d39504a..7ac9b38 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -65,11 +65,15 @@
             TT_INTERPRETER_VERSION_40 )
 #endif
 
-#define PROJECT( v1, v2 )                                                \
-          exc->func_project( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
-
-#define DUALPROJ( v1, v2 )                                                \
-          exc->func_dualproj( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
+#define PROJECT( v1, v2 )                                            \
+          exc->func_project( exc,                                    \
+                             OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                             OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
+
+#define DUALPROJ( v1, v2 )                                            \
+          exc->func_dualproj( exc,                                    \
+                              OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                              OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
 
 #define FAST_PROJECT( v )                          \
           exc->func_project( exc, (v)->x, (v)->y )