diff options
| author | Werner Lemberg <wl@gnu.org> | 2018-10-29 21:11:36 +0100 |
|---|---|---|
| committer | Werner Lemberg <wl@gnu.org> | 2018-10-29 21:11:36 +0100 |
| commit | ba62f9d8f5f85c6dda93b481271de37fb1f09e77 (patch) | |
| tree | 2679e0c34a5c3692c4b7086db30afdb5d5012e74 | |
| parent | acb19ed4e9c0cf1339e240069a252b9080dcb31e (diff) | |
| download | freetype2-ba62f9d8f5f85c6dda93b481271de37fb1f09e77.tar.gz | |
[cff] Fix numeric overflow.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988
* src/cff/cffparse.c (cff_parser_run)
[CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'.
| -rw-r--r-- | ChangeLog | 11 | ||||
| -rw-r--r-- | src/cff/cffparse.c | 2 |
2 files changed, 12 insertions, 1 deletions
@@ -1,3 +1,14 @@ +2018-10-29 Werner Lemberg <wl@gnu.org> + + [cff] Fix numeric overflow. + + Reported as + + https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988 + + * src/cff/cffparse.c (cff_parser_run) + [CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'. + 2018-10-27 Alexei Podtelezhnikov <apodtele@gmail.com> [sfnt] Make `head' timestamps unsigned. diff --git a/src/cff/cffparse.c b/src/cff/cffparse.c index e152c9381..b8b781817 100644 --- a/src/cff/cffparse.c +++ b/src/cff/cffparse.c @@ -1259,7 +1259,7 @@ if ( *stack < 0 ) { - num = (FT_ULong)-*stack; + num = (FT_ULong)NEG_LONG( *stack ); neg = 1; } else |