From c00b05f2028a91bf41fe7f33c3254ecad81a5d58 Mon Sep 17 00:00:00 2001
From: Werner Lemberg <wl@gnu.org>
Date: Fri, 20 Feb 2015 20:42:55 +0100
Subject: [PATCH] [cff] Thinkos in bias handling.

Only the final result is always positive.

Bug introduced three commits earlier.

* src/cff/cffgload.c, src/cff/cffgload.h: Apply.
---
 ChangeLog          | 10 ++++++++++
 src/cff/cffgload.c |  8 +++++---
 src/cff/cffgload.h |  4 ++--
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 976c1651b..d5436bed5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2015-02-20  Werner Lemberg  <wl@gnu.org>
+
+	[cff] Thinkos in bias handling.
+
+	Only the final result is always positive.
+
+	Bug introduced three commits earlier.
+
+	* src/cff/cffgload.c, src/cff/cffgload.h: Apply.
+
 2015-02-20  Werner Lemberg  <wl@gnu.org>
 
 	[cid] Fix signedness issues and emit some better error codes.
diff --git a/src/cff/cffgload.c b/src/cff/cffgload.c
index 0afa7454f..b20ad5070 100644
--- a/src/cff/cffgload.c
+++ b/src/cff/cffgload.c
@@ -337,7 +337,7 @@
   /*                                                                       */
   /* <Return>                                                              */
   /*    The bias value.                                                    */
-  static FT_UInt
+  static FT_Int
   cff_compute_bias( FT_Int   in_charstring_type,
                     FT_UInt  num_subrs )
   {
@@ -2385,7 +2385,8 @@
 
         case cff_op_callsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->locals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->locals_bias );
 
 
             FT_TRACE4(( " callsubr(%d)\n", idx ));
@@ -2426,7 +2427,8 @@
 
         case cff_op_callgsubr:
           {
-            FT_UInt  idx = ( (FT_UInt)args[0] >> 16 ) + decoder->globals_bias;
+            FT_UInt  idx = (FT_UInt)( ( args[0] >> 16 ) +
+                                      decoder->globals_bias );
 
 
             FT_TRACE4(( " callgsubr(%d)\n", idx ));
diff --git a/src/cff/cffgload.h b/src/cff/cffgload.h
index 39c5f3246..5c52d430d 100644
--- a/src/cff/cffgload.h
+++ b/src/cff/cffgload.h
@@ -178,8 +178,8 @@ FT_BEGIN_HEADER
     FT_UInt            num_locals;
     FT_UInt            num_globals;
 
-    FT_UInt            locals_bias;
-    FT_UInt            globals_bias;
+    FT_Int             locals_bias;
+    FT_Int             globals_bias;
 
     FT_Byte**          locals;
     FT_Byte**          globals;