From 0708b23e808eefb16a3a46abd738c040381fa0e3 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Wed, 17 Oct 2012 21:38:19 +0200
Subject: [PATCH] [psaux] Fix some value overflows.

* src/psaux/psconv.c (PS_Conv_ToFixed): Implement it.
---
 ChangeLog          |  6 ++++++
 src/psaux/psconv.c | 18 ++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 1e8975dd2..d9fb1a69b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2012-10-17  Werner Lemberg  <wl@gnu.org>
+
+	[psaux] Fix some value overflows.
+
+	* src/psaux/psconv.c (PS_Conv_ToFixed): Implement it.
+
 2012-10-17  Bram Tassyns  <BramT@enfocus.com>
 
 	[cff] Fix value overflow.
diff --git a/src/psaux/psconv.c b/src/psaux/psconv.c
index 9ea7fb988..df5308356 100644
--- a/src/psaux/psconv.c
+++ b/src/psaux/psconv.c
@@ -163,7 +163,14 @@
     }
 
     if ( *p != '.' )
-      integral = PS_Conv_ToInt( &p, limit ) << 16;
+    {
+      integral = PS_Conv_ToInt( &p, limit );
+
+      if ( integral > 0x7FFF )
+        return sign ? -0x7FFFFFFFL : 0x7FFFFFFFL;
+
+      integral <<= 16;
+    }
     else
       integral = 0;
 
@@ -210,6 +217,8 @@
 
     while ( power_ten > 0 )
     {
+      if ( integral >= 0xCCCCCCCL )
+        return sign ? -0x7FFFFFFFL : 0x7FFFFFFFL;
       integral *= 10;
       decimal  *= 10;
       power_ten--;
@@ -223,7 +232,12 @@
     }
 
     if ( decimal )
-      integral += FT_DivFix( decimal, divider );
+    {
+      decimal = FT_DivFix( decimal, divider );
+      if ( 0x7FFFFFFFL - decimal < integral )
+        return sign ? -0x7FFFFFFFL : 0x7FFFFFFFL;
+      integral += decimal;
+    }
 
     if ( sign )
       integral = -integral;