minhngoc25a
/
freetype2
mirror of git://git.savannah.gnu.org/freetype/freetype2.git
2
1
Fork 2
Code Issues 4 Releases Wiki Activity

[base] Fix UBSAN error. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166

* src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
larger than 32 bits.
This commit is contained in:
Werner Lemberg 2020-06-19 08:18:26 +02:00
parent 4d364b6821
commit d1180b5f95
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2020-06-19 Werner Lemberg <wl@gnu.org>
[base] Fix UBSAN error.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166
* src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
larger than 32 bits.
2020-06-19 Werner Lemberg <wl@gnu.org>
[woff2] Fix segfault.

7
src/base/ftoutln.c
View File

@ -1060,6 +1060,13 @@
if ( cbox.xMin == cbox.xMax || cbox.yMin == cbox.yMax )
return FT_ORIENTATION_NONE;
/* Reject values larger than 32bit. */
if ( (unsigned long)cbox.xMin > 0xFFFFFFFFUL ||
(unsigned long)cbox.xMax > 0xFFFFFFFFUL ||
(unsigned long)cbox.yMin > 0xFFFFFFFFUL ||
(unsigned long)cbox.yMax > 0xFFFFFFFFUL )
return FT_ORIENTATION_NONE;
xshift = FT_MSB( (FT_UInt32)( FT_ABS( cbox.xMax ) |
FT_ABS( cbox.xMin ) ) ) - 14;
xshift = FT_MAX( xshift, 0 );