diff options
| author | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2017-09-11 19:19:27 +0900 |
|---|---|---|
| committer | suzuki toshiya <mpsuzuki@hiroshima-u.ac.jp> | 2017-09-13 17:11:12 +0900 |
| commit | c122d3172c1906e1aec71afd34c2847e59625048 (patch) | |
| tree | 5d619ad1a81706468fbb4b21ba9d9db771706cf7 | |
| parent | 2d4f881acd00cbfe78a738e77acc6952606dc553 (diff) | |
| download | freetype2-c122d3172c1906e1aec71afd34c2847e59625048.tar.gz | |
To make large unsigned 16bit value, temporal bit shift like (1 << 16) can induce an overflow.
Change to make 32bit value by bitshifting and cast to 16bit in later.
| -rw-r--r-- | src/pfr/pfrload.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/pfr/pfrload.c b/src/pfr/pfrload.c index 4f8416582..53ce625a7 100644 --- a/src/pfr/pfrload.c +++ b/src/pfr/pfrload.c @@ -305,7 +305,7 @@ /* - we need at least 18 bytes for a log font record */ /* - the overall size is at least 95 bytes plus the */ /* log header and log font records */ - if ( count > ( ( 1 << 16 ) - 2 ) / 5 || + if ( count > (FT_UInt)(( 1L << 16 ) - 2 ) / 5 || 2 + count * 5 >= stream->size - section_offset || 95 + count * ( 5 + 18 ) >= stream->size ) { |