Re: [ft-devel] details on iPhone exploit caused by FreeType?

[Алексей Подтележников]

On Thu, Jul 14, 2011 at 12:00 PM, Werner LEMBERG <address@hidden> wrote:
>
> Here's the answer from Matthias.
>
>> 1) Fix2Int does shift before conversion.  How does it solve the
>>    undefined behavior with negative numbers?
>
> After the shift, the upper half is undefined.

This is wrong. Undefined means undefined in all halves.
Realistically though, the top bit in the lower part is still undefined,
depending if the sign bit is shifted or not.

I think it should be   (FT_Int) ( (FT_UInt)(f) >> 16 )