From c122d3172c1906e1aec71afd34c2847e59625048 Mon Sep 17 00:00:00 2001 From: suzuki toshiya Date: Mon, 11 Sep 2017 19:19:27 +0900 Subject: To make large unsigned 16bit value, temporal bit shift like (1 << 16) can induce an overflow. Change to make 32bit value by bitshifting and cast to 16bit in later. --- src/pfr/pfrload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pfr/pfrload.c b/src/pfr/pfrload.c index 4f8416582..53ce625a7 100644 --- a/src/pfr/pfrload.c +++ b/src/pfr/pfrload.c @@ -305,7 +305,7 @@ /* - we need at least 18 bytes for a log font record */ /* - the overall size is at least 95 bytes plus the */ /* log header and log font records */ - if ( count > ( ( 1 << 16 ) - 2 ) / 5 || + if ( count > (FT_UInt)(( 1L << 16 ) - 2 ) / 5 || 2 + count * 5 >= stream->size - section_offset || 95 + count * ( 5 + 18 ) >= stream->size ) { -- cgit v1.2.1