diff --git a/ChangeLog b/ChangeLog index a233f703c..c6e8229af 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,17 @@ +2017-07-03 Werner Lemberg + + [truetype] Integer overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2455 + + * src/truetype/ttinterp.c (Ins_SCFS): Use SUB_LONG. + +2017-07-01 Alexei Podtelezhnikov + + * src/sfnt/sfobjs.c (sfnt_load_face): Ignore No_Unicode_Glyph_Name. + 2017-06-28 Ben Wagner Avoid Microsoft compiler warnings (#51331). diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c index 04303e99e..152690878 100644 --- a/src/sfnt/sfobjs.c +++ b/src/sfnt/sfobjs.c @@ -1509,7 +1509,8 @@ NULL, &cmaprec, NULL ); if ( error && FT_ERR_NEQ( error, No_Unicode_Glyph_Name ) ) - FT_TRACE2(( "sfnt_load_face: failed to emulate Unicode\n" )); + goto Exit; + error = FT_Err_Ok; #endif /* FT_CONFIG_OPTION_POSTSCRIPT_NAMES */ diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index 24318bf1b..f8bf4af71 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -4803,7 +4803,7 @@ K = FAST_PROJECT( &exc->zp2.cur[L] ); - exc->func_move( exc, &exc->zp2, L, args[1] - K ); + exc->func_move( exc, &exc->zp2, L, SUB_LONG( args[1], K ) ); /* UNDOCUMENTED! The MS rasterizer does that with */ /* twilight points (confirmed by Greg Hitchcock) */