rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[truetype] Integer overflow. 

Changes triggered by

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3107

* src/truetype/ttinterp.c (Ins_MDRP, Ins_MIRP, Ins_ALIGNPTS): Use
NEG_LONG.
This commit is contained in:
Werner Lemberg 2017-08-22 08:25:14 +02:00
parent 7653c76533
commit 0aca17cf53
2 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2017-08-22 Werner Lemberg <wl@gnu.org>
[truetype] Integer overflow.
Changes triggered by
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3107
* src/truetype/ttinterp.c (Ins_MDRP, Ins_MIRP, Ins_ALIGNPTS): Use
NEG_LONG.
2017-08-17 Alexei Podtelezhnikov <apodtele@gmail.com>
[sfnt] Avoid synthetic unicode for symbol fonts with PUA.

15
src/truetype/ttinterp.c
View File

@ -6119,8 +6119,8 @@
}
else
{
if ( distance > -minimum_distance )
distance = -minimum_distance;
if ( distance > NEG_LONG( minimum_distance ) )
distance = NEG_LONG( minimum_distance );
}
}
@ -6303,8 +6303,8 @@
}
else
{
if ( distance > -minimum_distance )
distance = -minimum_distance;
if ( distance > NEG_LONG( minimum_distance ) )
distance = NEG_LONG( minimum_distance );
}
}
@ -6355,7 +6355,10 @@
}
if ( reverse_move )
exc->func_move( exc, &exc->zp1, point, -( distance - cur_dist ) );
exc->func_move( exc,
&exc->zp1,
point,
SUB_LONG( cur_dist, distance ) );
}
#endif /* TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY */
@ -6557,7 +6560,7 @@
distance = PROJECT( exc->zp0.cur + p2, exc->zp1.cur + p1 ) / 2;
exc->func_move( exc, &exc->zp1, p1, distance );
exc->func_move( exc, &exc->zp0, p2, -distance );
exc->func_move( exc, &exc->zp0, p2, NEG_LONG( distance ) );
}