diff options
| author | Werner Lemberg <wl@gnu.org> | 2022-11-14 19:18:19 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2022-11-14 19:18:19 +0100 |
| commit | e6fda039ad638866b7a6a5d046f03278ba1b7611 (patch) | |
| tree | 882208819f425bd2354eba340d7f33deef297a44 | |
| parent | 63ccaef07a048db66e7ac66ee241fb3d7751736f (diff) | |
| download | freetype2-e6fda039ad638866b7a6a5d046f03278ba1b7611.tar.gz | |
* src/truetype/ttgxvar.c (tt_hvadvance_adjust): Integer overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50462
| -rw-r--r-- | src/truetype/ttgxvar.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/truetype/ttgxvar.c b/src/truetype/ttgxvar.c index 370a92c7e..d2452f88c 100644 --- a/src/truetype/ttgxvar.c +++ b/src/truetype/ttgxvar.c @@ -42,6 +42,7 @@ #include <ft2build.h> #include <freetype/internal/ftdebug.h> #include FT_CONFIG_CONFIG_H +#include <freetype/internal/ftcalc.h> #include <freetype/internal/ftstream.h> #include <freetype/internal/sfnt.h> #include <freetype/tttags.h> @@ -1207,7 +1208,7 @@ delta == 1 ? "" : "s", vertical ? "VVAR" : "HVAR" )); - *avalue += delta; + *avalue = ADD_INT( *avalue, delta ); } Exit: |