[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master 0aca17c: [truetype] Integer overflow.
From: |
Werner LEMBERG |
Subject: |
[freetype2] master 0aca17c: [truetype] Integer overflow. |
Date: |
Tue, 22 Aug 2017 02:25:48 -0400 (EDT) |
branch: master
commit 0aca17cf53f099f9ea34b3797949076073b60b5d
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[truetype] Integer overflow.
Changes triggered by
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3107
* src/truetype/ttinterp.c (Ins_MDRP, Ins_MIRP, Ins_ALIGNPTS): Use
NEG_LONG.
---
ChangeLog | 11 +++++++++++
src/truetype/ttinterp.c | 15 +++++++++------
2 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 236842e..1031952 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2017-08-22 Werner Lemberg <address@hidden>
+
+ [truetype] Integer overflow.
+
+ Changes triggered by
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3107
+
+ * src/truetype/ttinterp.c (Ins_MDRP, Ins_MIRP, Ins_ALIGNPTS): Use
+ NEG_LONG.
+
2017-08-17 Alexei Podtelezhnikov <address@hidden>
[sfnt] Avoid synthetic unicode for symbol fonts with PUA.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index bc20155..ddcc839 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -6119,8 +6119,8 @@
}
else
{
- if ( distance > -minimum_distance )
- distance = -minimum_distance;
+ if ( distance > NEG_LONG( minimum_distance ) )
+ distance = NEG_LONG( minimum_distance );
}
}
@@ -6303,8 +6303,8 @@
}
else
{
- if ( distance > -minimum_distance )
- distance = -minimum_distance;
+ if ( distance > NEG_LONG( minimum_distance ) )
+ distance = NEG_LONG( minimum_distance );
}
}
@@ -6355,7 +6355,10 @@
}
if ( reverse_move )
- exc->func_move( exc, &exc->zp1, point, -( distance - cur_dist ) );
+ exc->func_move( exc,
+ &exc->zp1,
+ point,
+ SUB_LONG( cur_dist, distance ) );
}
#endif /* TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY */
@@ -6557,7 +6560,7 @@
distance = PROJECT( exc->zp0.cur + p2, exc->zp1.cur + p1 ) / 2;
exc->func_move( exc, &exc->zp1, p1, distance );
- exc->func_move( exc, &exc->zp0, p2, -distance );
+ exc->func_move( exc, &exc->zp0, p2, NEG_LONG( distance ) );
}
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master 0aca17c: [truetype] Integer overflow.,
Werner LEMBERG <=