[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master d1180b5: [base] Fix UBSAN error.
From: |
Werner LEMBERG |
Subject: |
[freetype2] master d1180b5: [base] Fix UBSAN error. |
Date: |
Fri, 19 Jun 2020 02:18:57 -0400 (EDT) |
branch: master
commit d1180b5f9598088ab1bc9d772e5e09ece0702a38
Author: Werner Lemberg <wl@gnu.org>
Commit: Werner Lemberg <wl@gnu.org>
[base] Fix UBSAN error.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166
* src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
larger than 32 bits.
---
ChangeLog | 11 +++++++++++
src/base/ftoutln.c | 7 +++++++
2 files changed, 18 insertions(+)
diff --git a/ChangeLog b/ChangeLog
index 950c19c..c7c9364 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
2020-06-19 Werner Lemberg <wl@gnu.org>
+ [base] Fix UBSAN error.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166
+
+ * src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
+ larger than 32 bits.
+
+2020-06-19 Werner Lemberg <wl@gnu.org>
+
[woff2] Fix segfault.
Reported as
diff --git a/src/base/ftoutln.c b/src/base/ftoutln.c
index 9935e05..6009bc3 100644
--- a/src/base/ftoutln.c
+++ b/src/base/ftoutln.c
@@ -1060,6 +1060,13 @@
if ( cbox.xMin == cbox.xMax || cbox.yMin == cbox.yMax )
return FT_ORIENTATION_NONE;
+ /* Reject values larger than 32bit. */
+ if ( (unsigned long)cbox.xMin > 0xFFFFFFFFUL ||
+ (unsigned long)cbox.xMax > 0xFFFFFFFFUL ||
+ (unsigned long)cbox.yMin > 0xFFFFFFFFUL ||
+ (unsigned long)cbox.yMax > 0xFFFFFFFFUL )
+ return FT_ORIENTATION_NONE;
+
xshift = FT_MSB( (FT_UInt32)( FT_ABS( cbox.xMax ) |
FT_ABS( cbox.xMin ) ) ) - 14;
xshift = FT_MAX( xshift, 0 );
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master d1180b5: [base] Fix UBSAN error.,
Werner LEMBERG <=