rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[base] Integer overflow. 

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2573

* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
FT_PIX_CEIL_LONG and FT_PIX_ROUND_LONG.
This commit is contained in:
Werner Lemberg 2017-07-12 22:16:37 +02:00
parent b5cab5c9ca
commit 134de096e0
2 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2017-07-12 Werner Lemberg <wl@gnu.org>
[base] Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2573
* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
FT_PIX_CEIL_LONG and FT_PIX_ROUND_LONG.
2017-07-12 Werner Lemberg <wl@gnu.org>
* src/truetype/ttpload.c (tt_face_get_location): Off-by-one typo.

20
src/base/ftobjs.c
View File

@ -579,12 +579,12 @@
if ( vertical )
{
metrics->horiBearingX = FT_PIX_FLOOR( metrics->horiBearingX );
metrics->horiBearingY = FT_PIX_CEIL ( metrics->horiBearingY );
metrics->horiBearingY = FT_PIX_CEIL_LONG( metrics->horiBearingY );
right = FT_PIX_CEIL( ADD_LONG( metrics->vertBearingX,
metrics->width ) );
bottom = FT_PIX_CEIL( ADD_LONG( metrics->vertBearingY,
metrics->height ) );
right = FT_PIX_CEIL_LONG( ADD_LONG( metrics->vertBearingX,
metrics->width ) );
bottom = FT_PIX_CEIL_LONG( ADD_LONG( metrics->vertBearingY,
metrics->height ) );
metrics->vertBearingX = FT_PIX_FLOOR( metrics->vertBearingX );
metrics->vertBearingY = FT_PIX_FLOOR( metrics->vertBearingY );
@ -599,13 +599,13 @@
metrics->vertBearingX = FT_PIX_FLOOR( metrics->vertBearingX );
metrics->vertBearingY = FT_PIX_FLOOR( metrics->vertBearingY );
right = FT_PIX_CEIL ( ADD_LONG( metrics->horiBearingX,
metrics->width ) );
right = FT_PIX_CEIL_LONG( ADD_LONG( metrics->horiBearingX,
metrics->width ) );
bottom = FT_PIX_FLOOR( SUB_LONG( metrics->horiBearingY,
metrics->height ) );
metrics->horiBearingX = FT_PIX_FLOOR( metrics->horiBearingX );
metrics->horiBearingY = FT_PIX_CEIL ( metrics->horiBearingY );
metrics->horiBearingY = FT_PIX_CEIL_LONG( metrics->horiBearingY );
metrics->width = SUB_LONG( right,
metrics->horiBearingX );
@ -613,8 +613,8 @@
bottom );
}
metrics->horiAdvance = FT_PIX_ROUND( metrics->horiAdvance );
metrics->vertAdvance = FT_PIX_ROUND( metrics->vertAdvance );
metrics->horiAdvance = FT_PIX_ROUND_LONG( metrics->horiAdvance );
metrics->vertAdvance = FT_PIX_ROUND_LONG( metrics->vertAdvance );
}
#endif /* GRID_FIT_METRICS */