diff options
| author | Werner Lemberg <wl@gnu.org> | 2017-06-02 09:21:37 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2017-06-02 09:21:37 +0200 |
| commit | 7a4276fb9095430b86b329f52fb8dfe26f966dcd (patch) | |
| tree | 8c2d6e9ce6daca45684ff9df584d86859e596b9b | |
| parent | 03b0cc2ea9b63f57ec58f77d8cc1350691d7140a (diff) | |
| download | freetype2-7a4276fb9095430b86b329f52fb8dfe26f966dcd.tar.gz | |
[cff] More integer overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032
* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
| -rw-r--r-- | ChangeLog | 10 | ||||
| -rw-r--r-- | src/cff/cf2blues.c | 9 |
2 files changed, 16 insertions, 3 deletions
@@ -1,5 +1,15 @@ 2017-06-02 Werner Lemberg <wl@gnu.org> + [cff] More integer overflows. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032 + + * src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32. + +2017-06-02 Werner Lemberg <wl@gnu.org> + [bdf] Don't left-shift negative numbers. Reported as diff --git a/src/cff/cf2blues.c b/src/cff/cf2blues.c index 141d0fcae..950c71473 100644 --- a/src/cff/cf2blues.c +++ b/src/cff/cf2blues.c @@ -301,7 +301,8 @@ /* top edge */ flatFamilyEdge = cf2_blueToFixed( familyOtherBlues[j + 1] ); - diff = cf2_fixedAbs( flatEdge - flatFamilyEdge ); + diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge, + flatFamilyEdge ) ); if ( diff < minDiff && diff < csUnitsPerPixel ) { @@ -319,7 +320,8 @@ /* top edge */ flatFamilyEdge = cf2_blueToFixed( familyBlues[1] ); - diff = cf2_fixedAbs( flatEdge - flatFamilyEdge ); + diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge, + flatFamilyEdge ) ); if ( diff < minDiff && diff < csUnitsPerPixel ) blues->zone[i].csFlatEdge = flatFamilyEdge; @@ -342,7 +344,8 @@ /* adjust edges of top zone upward by twice darkening amount */ flatFamilyEdge += 2 * font->darkenY; /* bottom edge */ - diff = cf2_fixedAbs( flatEdge - flatFamilyEdge ); + diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge, + flatFamilyEdge ) ); if ( diff < minDiff && diff < csUnitsPerPixel ) { |