diff options
| author | Werner Lemberg <wl@gnu.org> | 2017-07-12 22:16:37 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2017-07-12 22:16:37 +0200 |
| commit | 134de096e07c4b700ccff5226fcfe4c90ae2ed04 (patch) | |
| tree | 6621696a16fc9de0b695a16e0770085f85ce10c9 | |
| parent | b5cab5c9ca4afd8282a7f187185336c1c543c623 (diff) | |
| download | freetype2-134de096e07c4b700ccff5226fcfe4c90ae2ed04.tar.gz | |
[base] Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2573
* src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use
FT_PIX_CEIL_LONG and FT_PIX_ROUND_LONG.
| -rw-r--r-- | ChangeLog | 11 | ||||
| -rw-r--r-- | src/base/ftobjs.c | 20 |
2 files changed, 21 insertions, 10 deletions
@@ -1,5 +1,16 @@ 2017-07-12 Werner Lemberg <wl@gnu.org> + [base] Integer overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2573 + + * src/base/ftobjs.c (ft_glyphslot_grid_fit_metrics): Use + FT_PIX_CEIL_LONG and FT_PIX_ROUND_LONG. + +2017-07-12 Werner Lemberg <wl@gnu.org> + * src/truetype/ttpload.c (tt_face_get_location): Off-by-one typo. Also improve tracing message. diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index e190de3a3..1d8bc2d6c 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -579,12 +579,12 @@ if ( vertical ) { metrics->horiBearingX = FT_PIX_FLOOR( metrics->horiBearingX ); - metrics->horiBearingY = FT_PIX_CEIL ( metrics->horiBearingY ); + metrics->horiBearingY = FT_PIX_CEIL_LONG( metrics->horiBearingY ); - right = FT_PIX_CEIL( ADD_LONG( metrics->vertBearingX, - metrics->width ) ); - bottom = FT_PIX_CEIL( ADD_LONG( metrics->vertBearingY, - metrics->height ) ); + right = FT_PIX_CEIL_LONG( ADD_LONG( metrics->vertBearingX, + metrics->width ) ); + bottom = FT_PIX_CEIL_LONG( ADD_LONG( metrics->vertBearingY, + metrics->height ) ); metrics->vertBearingX = FT_PIX_FLOOR( metrics->vertBearingX ); metrics->vertBearingY = FT_PIX_FLOOR( metrics->vertBearingY ); @@ -599,13 +599,13 @@ metrics->vertBearingX = FT_PIX_FLOOR( metrics->vertBearingX ); metrics->vertBearingY = FT_PIX_FLOOR( metrics->vertBearingY ); - right = FT_PIX_CEIL ( ADD_LONG( metrics->horiBearingX, - metrics->width ) ); + right = FT_PIX_CEIL_LONG( ADD_LONG( metrics->horiBearingX, + metrics->width ) ); bottom = FT_PIX_FLOOR( SUB_LONG( metrics->horiBearingY, metrics->height ) ); metrics->horiBearingX = FT_PIX_FLOOR( metrics->horiBearingX ); - metrics->horiBearingY = FT_PIX_CEIL ( metrics->horiBearingY ); + metrics->horiBearingY = FT_PIX_CEIL_LONG( metrics->horiBearingY ); metrics->width = SUB_LONG( right, metrics->horiBearingX ); @@ -613,8 +613,8 @@ bottom ); } - metrics->horiAdvance = FT_PIX_ROUND( metrics->horiAdvance ); - metrics->vertAdvance = FT_PIX_ROUND( metrics->vertAdvance ); + metrics->horiAdvance = FT_PIX_ROUND_LONG( metrics->horiAdvance ); + metrics->vertAdvance = FT_PIX_ROUND_LONG( metrics->vertAdvance ); } #endif /* GRID_FIT_METRICS */ |