rgraves
/
freetype2
forked from minhngoc25a/freetype2
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

To make large unsigned 16bit value, temporal bit shift like (1 << 16) can induce an overflow. 

Change to make 32bit value by bitshifting and cast to 16bit in later.
This commit is contained in:
suzuki toshiya 2017-09-11 19:19:27 +09:00
parent 2d4f881acd
commit c122d3172c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/pfr/pfrload.c
View File

@ -305,7 +305,7 @@
/* - we need at least 18 bytes for a log font record */
/* - the overall size is at least 95 bytes plus the */
/* log header and log font records */
if ( count > ( ( 1 << 16 ) - 2 ) / 5 ||
if ( count > (FT_UInt)(( 1L << 16 ) - 2 ) / 5 ||
2 + count * 5 >= stream->size - section_offset ||
95 + count * ( 5 + 18 ) >= stream->size )
{