diff options
author | Werner Lemberg <wl@gnu.org> | 2017-06-05 06:20:53 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2017-06-05 06:20:53 +0200 |
commit | 8667042997cb9095d3c925417b29f5a3163ab352 (patch) | |
tree | 4a59bc1f79ab19ae03652a3e7704599591c947bd | |
parent | 9fa8a2997f869c6172a12a9497b3ca649806ec4d (diff) | |
download | freetype2-8667042997cb9095d3c925417b29f5a3163ab352.tar.gz |
[cff] Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2089
* src/cff/cffload.c (cff_blend_doBlend): User OVERFLOW_ADD_INT32.
-rw-r--r-- | ChangeLog | 10 | ||||
-rw-r--r-- | src/cff/cffload.c | 9 |
2 files changed, 16 insertions, 3 deletions
@@ -1,3 +1,13 @@ +2017-06-05 Werner Lemberg <wl@gnu.org> + + [cff] Integer overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2089 + + * src/cff/cffload.c (cff_blend_doBlend): User OVERFLOW_ADD_INT32. + 2017-06-04 Werner Lemberg <wl@gnu.org> [cff, truetype] Integer overflows. diff --git a/src/cff/cffload.c b/src/cff/cffload.c index 3beaeb1c8..2ee438755 100644 --- a/src/cff/cffload.c +++ b/src/cff/cffload.c @@ -1352,9 +1352,12 @@ sum = cff_parse_num( parser, &parser->stack[i + base] ) * 65536; for ( j = 1; j < blend->lenBV; j++ ) - sum += FT_MulFix( *weight++, - cff_parse_num( parser, - &parser->stack[delta++] ) * 65536 ); + sum = OVERFLOW_ADD_INT32( + sum, + FT_MulFix( + *weight++, + cff_parse_num( parser, + &parser->stack[delta++] ) * 65536 ) ); /* point parser stack to new value on blend_stack */ parser->stack[i + base] = subFont->blend_top; |