diff options
| author | Werner Lemberg <wl@gnu.org> | 2017-06-07 17:08:01 +0200 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2017-06-07 17:08:01 +0200 |
| commit | 7bffeacd7ef77d050e8bcbbc4e4ab761fa7861b9 (patch) | |
| tree | b9784811ee86c423d20ed75577d6cc277cdf6dcc | |
| parent | 24848a3d58cdd3ffd40ef3ddd68407d18f678b52 (diff) | |
| download | freetype2-7bffeacd7ef77d050e8bcbbc4e4ab761fa7861b9.tar.gz | |
[cff, truetype] Integer overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137
* src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.
* src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
OVERFLOW_SUB_LONG.
| -rw-r--r-- | ChangeLog | 16 | ||||
| -rw-r--r-- | src/cff/cf2hints.c | 2 | ||||
| -rw-r--r-- | src/truetype/ttinterp.c | 14 |
3 files changed, 25 insertions, 7 deletions
@@ -1,6 +1,20 @@ +2017-06-07 Werner Lemberg <wl@gnu.org> + + [cff, truetype] Integer overflows. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133 + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137 + + * src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32. + + * src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use + OVERFLOW_SUB_LONG. + 2017-06-06 Werner Lemberg <wl@gnu.org> - [cff] Integer overflow. + [cff] Integer overflows. Reported as diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c index e326c1b66..634b280bb 100644 --- a/src/cff/cf2hints.c +++ b/src/cff/cf2hints.c @@ -105,7 +105,7 @@ stemHintArray, indexStemHint ); - width = stemHint->max - stemHint->min; + width = OVERFLOW_SUB_INT32( stemHint->max, stemHint->min ); if ( width == cf2_intToFixed( -21 ) ) { diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c index d39504a26..7ac9b38d8 100644 --- a/src/truetype/ttinterp.c +++ b/src/truetype/ttinterp.c @@ -65,11 +65,15 @@ TT_INTERPRETER_VERSION_40 ) #endif -#define PROJECT( v1, v2 ) \ - exc->func_project( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y ) - -#define DUALPROJ( v1, v2 ) \ - exc->func_dualproj( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y ) +#define PROJECT( v1, v2 ) \ + exc->func_project( exc, \ + OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ), \ + OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) ) + +#define DUALPROJ( v1, v2 ) \ + exc->func_dualproj( exc, \ + OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ), \ + OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) ) #define FAST_PROJECT( v ) \ exc->func_project( exc, (v)->x, (v)->y ) |