diff options
| author | Arvinder Bhathal <arvinder.bhathal@gmail.com> | 2017-07-03 15:53:35 -0400 |
|---|---|---|
| committer | Arvinder Bhathal <arvinder.bhathal@gmail.com> | 2017-07-03 15:53:35 -0400 |
| commit | 2572b1bea7cc22ea3c1cd26e27a5bc7e997dfefb (patch) | |
| tree | d16dc14bbc91da71be0160b741c74b64ef61ec19 | |
| parent | 9cac2652896ad3bbcd795609e5d61f74dd899b27 (diff) | |
| parent | ca799e9be52526739691f120285a27b91fd15d68 (diff) | |
| download | freetype2-2572b1bea7cc22ea3c1cd26e27a5bc7e997dfefb.tar.gz | |
Merge branch 'master' of git.sv.gnu.org:/srv/git/freetype/freetype2 into arv-testing
| -rw-r--r-- | ChangeLog | 14 | ||||
| -rw-r--r-- | src/sfnt/sfobjs.c | 3 | ||||
| -rw-r--r-- | src/truetype/ttinterp.c | 2 |
3 files changed, 17 insertions, 2 deletions
@@ -1,3 +1,17 @@ +2017-07-03 Werner Lemberg <wl@gnu.org> + + [truetype] Integer overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2455 + + * src/truetype/ttinterp.c (Ins_SCFS): Use SUB_LONG. + +2017-07-01 Alexei Podtelezhnikov <apodtele@gmail.com> + + * src/sfnt/sfobjs.c (sfnt_load_face): Ignore No_Unicode_Glyph_Name. + 2017-06-28 Ben Wagner <bungeman@google.com> Avoid Microsoft compiler warnings (#51331). diff --git a/src/sfnt/sfobjs.c b/src/sfnt/sfobjs.c index 04303e99e..152690878 100644 --- a/src/sfnt/sfobjs.c +++ b/src/sfnt/sfobjs.c @@ -1509,7 +1509,8 @@ NULL, &cmaprec, NULL ); if ( error && FT_ERR_NEQ( error, No_Unicode_Glyph_Name ) ) - FT_TRACE2(( "sfnt_load_face: failed to emulate Unicode\n" )); + goto Exit; + error = FT_Err_Ok; #endif /* FT_CONFIG_OPTION_POSTSCRIPT_NAMES */ diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index 24318bf1b..f8bf4af71 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -4803,7 +4803,7 @@ K = FAST_PROJECT( &exc->zp2.cur[L] ); - exc->func_move( exc, &exc->zp2, L, args[1] - K ); + exc->func_move( exc, &exc->zp2, L, SUB_LONG( args[1], K ) ); /* UNDOCUMENTED! The MS rasterizer does that with */ /* twilight points (confirmed by Greg Hitchcock) */ |