rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[sfnt] Fix some signed overflows (#46149). 

* src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
<TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
This commit is contained in:
Werner Lemberg 2015-10-08 18:44:45 +02:00
parent 121122416d
commit 983b00ec86
2 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,10 @@
2015-10-08 Werner Lemberg <wl@gnu.org>
[sfnt] Fix some signed overflows (#46149).
* src/sfnt/ttsbit.c (tt_face_load_strike_metrics)
<TT_SBIT_TABLE_TYPE_SBIX>: Use `FT_MulDiv'.
2015-10-08 Werner Lemberg <wl@gnu.org>
[type1] Protect against invalid number of subroutines (#46150).

22
src/sfnt/ttsbit.c
View File

@ -269,11 +269,11 @@
case TT_SBIT_TABLE_TYPE_SBIX:
{
FT_Stream stream = face->root.stream;
FT_UInt offset, upem;
FT_UShort ppem, resolution;
FT_UInt offset;
FT_UShort upem, ppem, resolution;
TT_HoriHeader *hori;
FT_ULong table_size;
FT_Pos ppem_, upem_; /* to reduce casts */
FT_Pos ppem_; /* to reduce casts */
FT_Error error;
FT_Byte* p;
@ -307,14 +307,16 @@
metrics->y_ppem = ppem;
ppem_ = (FT_Pos)ppem;
upem_ = (FT_Pos)upem;
metrics->ascender = ppem_ * hori->Ascender * 64 / upem_;
metrics->descender = ppem_ * hori->Descender * 64 / upem_;
metrics->height = ppem_ * ( hori->Ascender -
hori->Descender +
hori->Line_Gap ) * 64 / upem_;
metrics->max_advance = ppem_ * hori->advance_Width_Max * 64 / upem_;
metrics->ascender =
FT_MulDiv( hori->Ascender, ppem_ * 64, upem );
metrics->descender =
FT_MulDiv( hori->Descender, ppem_ * 64, upem );
metrics->height =
FT_MulDiv( hori->Ascender - hori->Descender + hori->Line_Gap,
ppem_ * 64, upem );
metrics->max_advance =
FT_MulDiv( hori->advance_Width_Max, ppem_ * 64, upem );
return error;
}