summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBen Wagner <bungeman@google.com>2018-11-27 17:55:40 +0100
committerWerner Lemberg <wl@gnu.org>2018-11-27 17:56:25 +0100
commit74cdd75f6fb5c6df74f12e4724ecd84edab0dddd (patch)
treeb3292d4adbfa3b4ba716fb44e65eeaeef5caac00
parent1c4004bb345080fb5356402f30af83e648d0b503 (diff)
downloadfreetype2-74cdd75f6fb5c6df74f12e4724ecd84edab0dddd.tar.gz
[truetype] Fix numeric overflow (#55103).
* src/truetype/ttgload.c (compute_glyph_metrics): Use `SUB_LONG'.
-rw-r--r--ChangeLog6
-rw-r--r--src/truetype/ttgload.c2
2 files changed, 7 insertions, 1 deletions
diff --git a/ChangeLog b/ChangeLog
index 04b4fbd3d..b10dffbfe 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-11-27 Ben Wagner <bungeman@google.com>
+
+ [truetype Fix numeric overflow (#55103).
+
+ * src/truetype/ttgload.c (compute_glyph_metrics): Use `SUB_LONG'.
+
2018-11-18 Alexei Podtelezhnikov <apodtele@gmail.com>
[builds] Belated DLL support with vc2002-vc2008.
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c
index 3028622f7..1d84450a8 100644
--- a/src/truetype/ttgload.c
+++ b/src/truetype/ttgload.c
@@ -2160,7 +2160,7 @@
glyph->metrics.horiBearingX = bbox.xMin;
glyph->metrics.horiBearingY = bbox.yMax;
- glyph->metrics.horiAdvance = loader->pp2.x - loader->pp1.x;
+ glyph->metrics.horiAdvance = SUB_LONG(loader->pp2.x, loader->pp1.x);
/* Adjust advance width to the value contained in the hdmx table */
/* unless FT_LOAD_COMPUTE_METRICS is set or backward compatibility */