minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 9 Releases Wiki Activity

[cff] Integer overflow. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2089

* src/cff/cffload.c (cff_blend_doBlend): User OVERFLOW_ADD_INT32.
This commit is contained in:
Werner Lemberg 2017-06-05 06:20:53 +02:00
parent 9fa8a2997f
commit 8667042997
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog
View File

@ -1,3 +1,13 @@
2017-06-05 Werner Lemberg <wl@gnu.org>
[cff] Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2089
* src/cff/cffload.c (cff_blend_doBlend): User OVERFLOW_ADD_INT32.
2017-06-04 Werner Lemberg <wl@gnu.org>
[cff, truetype] Integer overflows.

9
src/cff/cffload.c
View File

@ -1352,9 +1352,12 @@
sum = cff_parse_num( parser, &parser->stack[i + base] ) * 65536;
for ( j = 1; j < blend->lenBV; j++ )
sum += FT_MulFix( *weight++,
cff_parse_num( parser,
&parser->stack[delta++] ) * 65536 );
sum = OVERFLOW_ADD_INT32(
sum,
FT_MulFix(
*weight++,
cff_parse_num( parser,
&parser->stack[delta++] ) * 65536 ) );
/* point parser stack to new value on blend_stack */
parser->stack[i + base] = subFont->blend_top;