[Git][freetype/freetype][master] * src/sfnt/ttcolr.c (read_paint): Fix undefined left-shift operation.

[Werner Lemberg (@wl)]

Werner Lemberg pushed to branch master at FreeType / FreeType

Commits:

• 947fddc8
  by Werner Lemberg at 2022-01-11T08:27:26+00:00

  * src/sfnt/ttcolr.c (read_paint): Fix undefined left-shift operation.
  
  Reported as
  
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43151
  

1 changed file:

• src/sfnt/ttcolr.c

Changes:

src/sfnt/ttcolr.c

---

...	...	@@ -522,19 +522,29 @@
522	522
523	523	else if ( apaint->format == FT_COLR_PAINTFORMAT_RADIAL_GRADIENT )
524	524	{
	525	+ FT_Pos tmp;
	526	+
	527	+
525	528	if ( !read_color_line( child_table_p,
526	529	&apaint->u.radial_gradient.colorline ) )
527	530	return 0;
528	531
	532	+ /* In the OpenType specification, `r0` and `r1` are defined as */
	533	+ /* `UFWORD`. Since FreeType doesn't have a corresponding 16.16 */
	534	+ /* format we convert to `FWORD` and replace negative values with */
	535	+ /* (32bit) `FT_INT_MAX`. */
	536	+
529	537	apaint->u.radial_gradient.c0.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
530	538	apaint->u.radial_gradient.c0.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
531	539
532		- apaint->u.radial_gradient.r0 = FT_NEXT_USHORT( p ) << 16;
	540	+ tmp = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	541	+ apaint->u.radial_gradient.r0 = tmp < 0 ? FT_INT_MAX : tmp;
533	542
534	543	apaint->u.radial_gradient.c1.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
535	544	apaint->u.radial_gradient.c1.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
536	545
537		- apaint->u.radial_gradient.r1 = FT_NEXT_USHORT( p ) << 16;
	546	+ tmp = INT_TO_FIXED( FT_NEXT_SHORT( p ) );
	547	+ apaint->u.radial_gradient.r1 = tmp < 0 ? FT_INT_MAX : tmp;
538	548
539	549	return 1;
540	550	}

—
View it on GitLab.
You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings.