[truetype] Fix integer overflow.
Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35312 * src/truetype/ttinterp.c (Ins_JMPR): Use `ADD_LONG`.
This commit is contained in:
parent
232243e749
commit
b460a50610
10
ChangeLog
10
ChangeLog
|
@ -1,3 +1,13 @@
|
||||||
|
2021-06-19 Werner Lemberg <david@freetype.org>
|
||||||
|
|
||||||
|
[truetype] Fix integer overflow.
|
||||||
|
|
||||||
|
Reported as
|
||||||
|
|
||||||
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35312
|
||||||
|
|
||||||
|
* src/truetype/ttinterp.c (Ins_JMPR): Use `ADD_LONG`.
|
||||||
|
|
||||||
2021-06-19 Werner Lemberg <david@freetype.org>
|
2021-06-19 Werner Lemberg <david@freetype.org>
|
||||||
|
|
||||||
[autofit] Prevent hinting if there are too many segments.
|
[autofit] Prevent hinting if there are too many segments.
|
||||||
|
|
|
@ -3593,7 +3593,7 @@
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
exc->IP += args[0];
|
exc->IP = ADD_LONG( exc->IP, args[0] );
|
||||||
if ( exc->IP < 0 ||
|
if ( exc->IP < 0 ||
|
||||||
( exc->callTop > 0 &&
|
( exc->callTop > 0 &&
|
||||||
exc->IP > exc->callStack[exc->callTop - 1].Def->end ) )
|
exc->IP > exc->callStack[exc->callTop - 1].Def->end ) )
|
||||||
|
|
Loading…
Reference in New Issue