diff --git a/ChangeLog b/ChangeLog index 60da292fb..f38b20181 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,14 @@ +2018-08-29 Armin Hasitzka + + Fix numeric overflows. + + * src/pshint/pshalgo.c (psh_hint_align, psh_hint_align_light, + psh_hint_table_find_strong_points): Fix numeric overflows. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10083 + 2018-08-29 Werner Lemberg [cff] Fix handling of `roll' op in old engine. diff --git a/src/pshinter/pshalgo.c b/src/pshinter/pshalgo.c index 1a365488f..fcdaf6e6b 100644 --- a/src/pshinter/pshalgo.c +++ b/src/pshinter/pshalgo.c @@ -479,7 +479,7 @@ if ( dimension == 1 ) psh_blues_snap_stem( &globals->blues, - hint->org_pos + hint->org_len, + ADD_INT( hint->org_pos, hint->org_len ), hint->org_pos, &align ); @@ -703,7 +703,7 @@ if ( dimension == 1 ) psh_blues_snap_stem( &globals->blues, - hint->org_pos + hint->org_len, + ADD_INT( hint->org_pos, hint->org_len ), hint->org_pos, &align ); @@ -1538,8 +1538,8 @@ PSH_Hint hint = sort[nn]; - if ( org_u >= hint->org_pos && - org_u <= hint->org_pos + hint->org_len ) + if ( org_u >= hint->org_pos && + org_u <= ADD_INT( hint->org_pos, hint->org_len ) ) { point->hint = hint; break;