From 70ac167c47f5ca966fb578b1f215430f46915a49 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Mon, 16 Apr 2018 10:39:10 +0200 Subject: [truetype] Integer overflow issues. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7718 * src/truetype/ttinterp.c (Ins_MIRP): Use ADD_LONG. --- ChangeLog | 14 ++++++++++++-- src/truetype/ttinterp.c | 2 +- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 0197dcb29..316256098 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,13 @@ +2018-04-16 Werner Lemberg + + [truetype] Integer overflow issues. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7718 + + * src/truetype/ttinterp.c (Ins_MIRP): Use ADD_LONG. + 2018-04-15 Alexei Podtelezhnikov [build] Use `info' function of make 3.81. @@ -46,7 +56,7 @@ 2018-04-10 Nikolaus Waxweiler - * CMakeLists.txt, builds/cmake/FindHarfBuzz.cmake: Extensive + * CMakeLists.txt, builds/cmake/FindHarfBuzz.cmake: Extensive modernization measures. This brings up the minimum required CMake version to 2.8.12. @@ -102,7 +112,7 @@ builds/windows/vc2008/freetype.vcproj, builds/windows/visualce/freetype.vcproj, builds/windows/visualce/freetype.dsp, - builds/windows/visualc/freetype.vcproj, + builds/windows/visualc/freetype.vcproj, builds/windows/visualc/freetype.dsp: Remove per-file compile flags. 2018-04-04 Werner Lemberg diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index c66c69929..336b46b42 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -6193,7 +6193,7 @@ minimum_distance = exc->GS.minimum_distance; control_value_cutin = exc->GS.control_value_cutin; point = (FT_UShort)args[0]; - cvtEntry = (FT_ULong)( args[1] + 1 ); + cvtEntry = (FT_ULong)( ADD_LONG( args[1], 1 ) ); #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY if ( SUBPIXEL_HINTING_INFINALITY && -- cgit v1.2.1