diff options
| author | Werner Lemberg <wl@gnu.org> | 2022-01-09 07:26:26 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-01-11 08:27:26 +0000 |
| commit | 947fddc8da622640145550fdc4203a468a6e8512 (patch) | |
| tree | f5e3f3f4dab9c5f63cd4af085a3e324f880293ce | |
| parent | 639a02154b36fea925a145061138385164932c4c (diff) | |
| download | freetype2-947fddc8da622640145550fdc4203a468a6e8512.tar.gz | |
* src/sfnt/ttcolr.c (read_paint): Fix undefined left-shift operation.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43151
| -rw-r--r-- | src/sfnt/ttcolr.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/src/sfnt/ttcolr.c b/src/sfnt/ttcolr.c index 326c0e9b2..07d95d928 100644 --- a/src/sfnt/ttcolr.c +++ b/src/sfnt/ttcolr.c @@ -522,19 +522,29 @@ else if ( apaint->format == FT_COLR_PAINTFORMAT_RADIAL_GRADIENT ) { + FT_Pos tmp; + + if ( !read_color_line( child_table_p, &apaint->u.radial_gradient.colorline ) ) return 0; + /* In the OpenType specification, `r0` and `r1` are defined as */ + /* `UFWORD`. Since FreeType doesn't have a corresponding 16.16 */ + /* format we convert to `FWORD` and replace negative values with */ + /* (32bit) `FT_INT_MAX`. */ + apaint->u.radial_gradient.c0.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); apaint->u.radial_gradient.c0.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); - apaint->u.radial_gradient.r0 = FT_NEXT_USHORT( p ) << 16; + tmp = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); + apaint->u.radial_gradient.r0 = tmp < 0 ? FT_INT_MAX : tmp; apaint->u.radial_gradient.c1.x = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); apaint->u.radial_gradient.c1.y = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); - apaint->u.radial_gradient.r1 = FT_NEXT_USHORT( p ) << 16; + tmp = INT_TO_FIXED( FT_NEXT_SHORT( p ) ); + apaint->u.radial_gradient.r1 = tmp < 0 ? FT_INT_MAX : tmp; return 1; } |