diff options
| author | Werner Lemberg <wl@gnu.org> | 2022-04-19 09:28:21 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-04-19 09:34:10 +0200 |
| commit | 079a22da037835daf5be2bd9eccf7bc1eaa2e783 (patch) | |
| tree | 062124442286ef51d3f7a8e3697822240e260603 /src/truetype/ttgload.c | |
| parent | 978eefee5401abee6bf702c6bcde9afb47893145 (diff) | |
| download | freetype2-079a22da037835daf5be2bd9eccf7bc1eaa2e783.tar.gz | |
* src/truetype/ttgload.c (TT_Process_Simple_Glyph): Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46792
Diffstat (limited to 'src/truetype/ttgload.c')
| -rw-r--r-- | src/truetype/ttgload.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/truetype/ttgload.c b/src/truetype/ttgload.c index 0ecde22b7..2ca63d65a 100644 --- a/src/truetype/ttgload.c +++ b/src/truetype/ttgload.c @@ -1104,8 +1104,8 @@ for ( ; vec < limit; vec++, u++ ) { - vec->x = ( FT_MulFix( u->x, x_scale ) + 32 ) >> 6; - vec->y = ( FT_MulFix( u->y, y_scale ) + 32 ) >> 6; + vec->x = ADD_LONG( FT_MulFix( u->x, x_scale ), 32 ) >> 6; + vec->y = ADD_LONG( FT_MulFix( u->y, y_scale ), 32 ) >> 6; } } else |