From 720ae67f35701819f6bf3fd9337dc89079a4ed27 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sun, 5 Aug 2018 07:21:10 +0200 Subject: [PATCH] * src/truetype/ttgload.c (compute_glyph_metrics): Fix overflow. Reported as https://bugs.chromium.org/p/chromium/issues/detail?id=777151 --- ChangeLog | 8 ++++++++ src/truetype/ttgload.c | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index a573e4a13..7f0793dc6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2018-08-05 Werner Lemberg + + * src/truetype/ttgload.c (compute_glyph_metrics): Fix overflow. + + Reported as + + https://bugs.chromium.org/p/chromium/issues/detail?id=777151 + 2018-08-04 Werner Lemberg * src/truetype/ttinterp.c (opcode_name): Fix typos. diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c index f0f6a0602..9e98f1169 100644 --- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -2284,13 +2284,13 @@ /* XXX: for now, we have no better algorithm for the lsb, but it */ /* should work fine. */ /* */ - glyph->metrics.vertBearingX = glyph->metrics.horiBearingX - - glyph->metrics.horiAdvance / 2; + glyph->metrics.vertBearingX = SUB_LONG( glyph->metrics.horiBearingX, + glyph->metrics.horiAdvance / 2 ); glyph->metrics.vertBearingY = top; glyph->metrics.vertAdvance = advance; } - return 0; + return FT_Err_Ok; }