diff --git a/ChangeLog b/ChangeLog index f7897215c..69e627502 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2017-09-21 Werner Lemberg + + [truetype] Integer overflow (#52082). + + * src/truetype/ttinterp.c (Ins_MDRP): Avoid FT_ABS. + 2017-09-21 Werner Lemberg [sfnt] Fix postscript name for default instance of variation fonts. diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index c3d710359..e3c8f1289 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -6078,8 +6078,9 @@ /* single width cut-in test */ - if ( FT_ABS( org_dist - exc->GS.single_width_value ) < - exc->GS.single_width_cutin ) + /* |org_dist - single_width_value| < single_width_cutin */ + if ( org_dist < exc->GS.single_width_value + exc->GS.single_width_cutin || + org_dist > exc->GS.single_width_value - exc->GS.single_width_cutin ) { if ( org_dist >= 0 ) org_dist = exc->GS.single_width_value;