From abeb28f161bc11be4fcdb8af50ab4b736d34a3e5 Mon Sep 17 00:00:00 2001 From: Alexei Podtelezhnikov Date: Sat, 1 Jul 2017 16:48:32 -0400 Subject: [PATCH 1/2] * src/sfnt/sfobjs.c (sfnt_load_face): Ignore No_Unicode_Glyph_Name. --- ChangeLog | 4 ++++ src/sfnt/sfobjs.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index a233f703c..30cf6304a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +2017-07-01 Alexei Podtelezhnikov + + * src/sfnt/sfobjs.c (sfnt_load_face): Ignore No_Unicode_Glyph_Name. + 2017-06-28 Ben Wagner Avoid Microsoft compiler warnings (#51331). diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c index 04303e99e..152690878 100644 --- a/src/sfnt/sfobjs.c +++ b/src/sfnt/sfobjs.c @@ -1509,7 +1509,8 @@ NULL, &cmaprec, NULL ); if ( error && FT_ERR_NEQ( error, No_Unicode_Glyph_Name ) ) - FT_TRACE2(( "sfnt_load_face: failed to emulate Unicode\n" )); + goto Exit; + error = FT_Err_Ok; #endif /* FT_CONFIG_OPTION_POSTSCRIPT_NAMES */ From ca799e9be52526739691f120285a27b91fd15d68 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 3 Jul 2017 06:27:52 +0200 Subject: [PATCH 2/2] [truetype] Integer overflow. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2455 * src/truetype/ttinterp.c (Ins_SCFS): Use SUB_LONG. --- ChangeLog | 10 ++++++++++ src/truetype/ttinterp.c | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 30cf6304a..c6e8229af 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +2017-07-03 Werner Lemberg + + [truetype] Integer overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2455 + + * src/truetype/ttinterp.c (Ins_SCFS): Use SUB_LONG. + 2017-07-01 Alexei Podtelezhnikov * src/sfnt/sfobjs.c (sfnt_load_face): Ignore No_Unicode_Glyph_Name. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index 24318bf1b..f8bf4af71 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -4803,7 +4803,7 @@ K = FAST_PROJECT( &exc->zp2.cur[L] ); - exc->func_move( exc, &exc->zp2, L, args[1] - K ); + exc->func_move( exc, &exc->zp2, L, SUB_LONG( args[1], K ) ); /* UNDOCUMENTED! The MS rasterizer does that with */ /* twilight points (confirmed by Greg Hitchcock) */