AuroraMiddleware/freetype
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix numeric overflows.

Browse Source 
* src/pshint/pshalgo.c (psh_hint_align, psh_hint_align_light,
psh_hint_table_find_strong_points): Fix numeric overflows.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10083
This commit is contained in:
Armin Hasitzka 2018-08-29 15:28:21 +02:00
parent 14dff08f37
commit 934a6159ba
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ChangeLog
View File

@ -1,3 +1,14 @@
2018-08-29 Armin Hasitzka <prince.cherusker@gmail.com>
Fix numeric overflows.
* src/pshint/pshalgo.c (psh_hint_align, psh_hint_align_light,
psh_hint_table_find_strong_points): Fix numeric overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10083
2018-08-29 Werner Lemberg <wl@gnu.org>
[cff] Fix handling of `roll' op in old engine.

8
src/pshinter/pshalgo.c
View File

@ -479,7 +479,7 @@
if ( dimension == 1 )
psh_blues_snap_stem( &globals->blues,
hint->org_pos + hint->org_len,
ADD_INT( hint->org_pos, hint->org_len ),
hint->org_pos,
&align );
@ -703,7 +703,7 @@
if ( dimension == 1 )
psh_blues_snap_stem( &globals->blues,
hint->org_pos + hint->org_len,
ADD_INT( hint->org_pos, hint->org_len ),
hint->org_pos,
&align );
@ -1538,8 +1538,8 @@
PSH_Hint hint = sort[nn];
if ( org_u >= hint->org_pos &&
org_u <= hint->org_pos + hint->org_len )
if ( org_u >= hint->org_pos &&
org_u <= ADD_INT( hint->org_pos, hint->org_len ) )
{
point->hint = hint;
break;