diff options
| author | Werner Lemberg <wl@gnu.org> | 2017-10-08 11:58:39 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2017-10-08 11:58:39 +0200 |
| commit | b7e43f7d7dc9a2fdb488c989162272e840c88bb8 (patch) | |
| tree | 0e371bd91a9369bc4eaa461366beec911b6f8aac | |
| parent | 08e2e311ef0d59e45f845fbd24cc20bea6e2e72d (diff) | |
| download | freetype2-b7e43f7d7dc9a2fdb488c989162272e840c88bb8.tar.gz | |
* src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Integer overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3579
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | src/base/ftobjs.c | 20 |
2 files changed, 18 insertions, 10 deletions
@@ -1,3 +1,11 @@ +2017-10-08 Werner Lemberg <wl@gnu.org> + + * src/base/ftobjs.c (ft_glyphslot_preset_bitmap): Integer overflows. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3579 + 2017-10-07 Werner Lemberg <wl@gnu.org> [sfnt] Adjust behaviour of PS font names for variation fonts. diff --git a/src/base/ftobjs.c b/src/base/ftobjs.c index 2258a3175..3569ca213 100644 --- a/src/base/ftobjs.c +++ b/src/base/ftobjs.c @@ -372,29 +372,29 @@ if ( cbox.xMax - cbox.xMin < 64 ) { cbox.xMin = FT_PIX_FLOOR( cbox.xMin ); - cbox.xMax = FT_PIX_CEIL( cbox.xMax ); + cbox.xMax = FT_PIX_CEIL_LONG( cbox.xMax ); } else { - cbox.xMin = FT_PIX_ROUND( cbox.xMin ); - cbox.xMax = FT_PIX_ROUND( cbox.xMax ); + cbox.xMin = FT_PIX_ROUND_LONG( cbox.xMin ); + cbox.xMax = FT_PIX_ROUND_LONG( cbox.xMax ); } if ( cbox.yMax - cbox.yMin < 64 ) { cbox.yMin = FT_PIX_FLOOR( cbox.yMin ); - cbox.yMax = FT_PIX_CEIL( cbox.yMax ); + cbox.yMax = FT_PIX_CEIL_LONG( cbox.yMax ); } else { - cbox.yMin = FT_PIX_ROUND( cbox.yMin ); - cbox.yMax = FT_PIX_ROUND( cbox.yMax ); + cbox.yMin = FT_PIX_ROUND_LONG( cbox.yMin ); + cbox.yMax = FT_PIX_ROUND_LONG( cbox.yMax ); } #else cbox.xMin = FT_PIX_FLOOR( cbox.xMin ); cbox.yMin = FT_PIX_FLOOR( cbox.yMin ); - cbox.xMax = FT_PIX_CEIL( cbox.xMax ); - cbox.yMax = FT_PIX_CEIL( cbox.yMax ); + cbox.xMax = FT_PIX_CEIL_LONG( cbox.xMax ); + cbox.yMax = FT_PIX_CEIL_LONG( cbox.yMax ); #endif break; @@ -415,8 +415,8 @@ Round: cbox.xMin = FT_PIX_FLOOR( cbox.xMin ); cbox.yMin = FT_PIX_FLOOR( cbox.yMin ); - cbox.xMax = FT_PIX_CEIL( cbox.xMax ); - cbox.yMax = FT_PIX_CEIL( cbox.yMax ); + cbox.xMax = FT_PIX_CEIL_LONG( cbox.xMax ); + cbox.yMax = FT_PIX_CEIL_LONG( cbox.yMax ); } x_shift = SUB_LONG( x_shift, cbox.xMin ); |