From 72fbb0bc7915dedd7742873ab9289767f1301291 Mon Sep 17 00:00:00 2001 From: Werner Lemberg Date: Sat, 19 Mar 2022 06:40:17 +0100 Subject: [Backport] CVE-2022-27405 (1/2) Cherry-pick of patch originally submitted at https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5: * src/base/ftobjs.c (ft_open_face_internal): Properly guard `face_index`. We must ensure that the cast to `FT_Int` doesn't change the sign. Fixes #1139. Change-Id: Ic63e379d5c65bd56d5ca07b80a7015d9f5bc0051 Reviewed-by: Michal Klocek --- chromium/third_party/freetype/src/src/base/ftobjs.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/chromium/third_party/freetype/src/src/base/ftobjs.c b/chromium/third_party/freetype/src/src/base/ftobjs.c index 5c1a4d034a4..e701e23a308 100644 --- a/chromium/third_party/freetype/src/src/base/ftobjs.c +++ b/chromium/third_party/freetype/src/src/base/ftobjs.c @@ -2451,6 +2451,15 @@ #endif + /* only use lower 31 bits together with sign bit */ + if ( face_index > 0 ) + face_index &= 0x7FFFFFFFL; + else + { + face_index &= 0x7FFFFFFFL; + face_index = -face_index; + } + #ifdef FT_DEBUG_LEVEL_TRACE FT_TRACE3(( "FT_Open_Face: " )); if ( face_index < 0 ) -- cgit v1.2.1