[truetype] Integer overflow.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2868 * src/truetype/ttinterp.c (Ins_ALIGNRP): Use NEG_LONG.
This commit is contained in:
parent
f43b3094ef
commit
17196b7c74
10
ChangeLog
10
ChangeLog
|
@ -1,3 +1,13 @@
|
|||
2017-06-27 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
[truetype] Integer overflow.
|
||||
|
||||
Reported as
|
||||
|
||||
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2868
|
||||
|
||||
* src/truetype/ttinterp.c (Ins_ALIGNRP): Use NEG_LONG.
|
||||
|
||||
2017-08-05 Werner Lemberg <wl@gnu.org>
|
||||
|
||||
[base, truetype] New function `FT_Get_Var_Axis_Flags'.
|
||||
|
|
|
@ -6421,7 +6421,7 @@
|
|||
distance = PROJECT( exc->zp1.cur + point,
|
||||
exc->zp0.cur + exc->GS.rp0 );
|
||||
|
||||
exc->func_move( exc, &exc->zp1, point, -distance );
|
||||
exc->func_move( exc, &exc->zp1, point, NEG_LONG( distance ) );
|
||||
}
|
||||
|
||||
exc->GS.loop--;
|
||||
|
|
Loading…
Reference in New Issue