AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[cff] Integer overflow.

Browse Source 
Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2109
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2110
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2122

* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.

* src/cff/cf2hints.c (cf2_hintmap_map): Synchronize if-else
branches.
This commit is contained in:
Werner Lemberg 2017-06-06 12:05:04 +02:00
parent 8667042997
commit 24848a3d58
3 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ChangeLog
View File

@ -1,3 +1,18 @@
2017-06-06 Werner Lemberg <wl@gnu.org>
[cff] Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2109
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2110
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2122
* src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
* src/cff/cf2hints.c (cf2_hintmap_map): Synchronize if-else
branches.
2017-06-05 Werner Lemberg <wl@gnu.org>
[cff] Integer overflow.

5
src/cff/cf2blues.c
View File

@ -194,8 +194,9 @@
blues->zone[blues->count].csTopEdge =
cf2_blueToFixed( blueValues[i + 1] );
zoneHeight = blues->zone[blues->count].csTopEdge -
blues->zone[blues->count].csBottomEdge;
zoneHeight = OVERFLOW_SUB_INT32(
blues->zone[blues->count].csTopEdge,
blues->zone[blues->count].csBottomEdge );
if ( zoneHeight < 0 )
{

3
src/cff/cf2hints.c
View File

@ -332,7 +332,8 @@
{
/* special case for points below first edge: use uniform scale */
return OVERFLOW_ADD_INT32(
FT_MulFix( csCoord - hintmap->edge[0].csCoord,
FT_MulFix( OVERFLOW_SUB_INT32( csCoord,
hintmap->edge[0].csCoord ),
hintmap->scale ),
hintmap->edge[0].dsCoord );
}