diff options
author | Werner Lemberg <wl@gnu.org> | 2017-06-02 08:44:20 +0200 |
---|---|---|
committer | Werner Lemberg <wl@gnu.org> | 2017-06-02 08:44:20 +0200 |
commit | 3802ca8b643dbc966d12ef11ed8e2e5893cabef2 (patch) | |
tree | 2ea7a11970b43fbe531744d0e93bc0df2da5a56c /src/cff | |
parent | cd02d359a6d0455e9d16b87bf9665961c4699538 (diff) | |
download | freetype2-3802ca8b643dbc966d12ef11ed8e2e5893cabef2.tar.gz |
[cff] Fix integer overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2027
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2028
* src/cff/cf2hints.c (cf2_hintmap_insertHint), src/cff/cf2intrp.c
(cf2_doFlex): Use OVERFLOW_ADD_INT32 and OVERFLOW_SUB_INT32.
Diffstat (limited to 'src/cff')
-rw-r--r-- | src/cff/cf2hints.c | 18 | ||||
-rw-r--r-- | src/cff/cf2intrp.c | 7 |
2 files changed, 15 insertions, 10 deletions
diff --git a/src/cff/cf2hints.c b/src/cff/cf2hints.c index 5efb180dc..dbd3c8864 100644 --- a/src/cff/cf2hints.c +++ b/src/cff/cf2hints.c @@ -638,14 +638,16 @@ { /* Use hint map to position the center of stem, and nominal scale */ /* to position the two edges. This preserves the stem width. */ - CF2_Fixed midpoint = cf2_hintmap_map( - hintmap->initialHintMap, - ( secondHintEdge->csCoord + - firstHintEdge->csCoord ) / 2 ); - CF2_Fixed halfWidth = FT_MulFix( - ( secondHintEdge->csCoord - - firstHintEdge->csCoord ) / 2, - hintmap->scale ); + CF2_Fixed midpoint = + cf2_hintmap_map( + hintmap->initialHintMap, + OVERFLOW_ADD_INT32( secondHintEdge->csCoord, + firstHintEdge->csCoord ) / 2 ); + CF2_Fixed halfWidth = + FT_MulFix( + OVERFLOW_SUB_INT32( secondHintEdge->csCoord, + firstHintEdge->csCoord ) / 2, + hintmap->scale ); firstHintEdge->dsCoord = midpoint - halfWidth; diff --git a/src/cff/cf2intrp.c b/src/cff/cf2intrp.c index 8f0785d59..463b7e89b 100644 --- a/src/cff/cf2intrp.c +++ b/src/cff/cf2intrp.c @@ -358,8 +358,11 @@ if ( doConditionalLastRead ) { - FT_Bool lastIsX = (FT_Bool)( cf2_fixedAbs( vals[10] - *curX ) > - cf2_fixedAbs( vals[11] - *curY ) ); + FT_Bool lastIsX = (FT_Bool)( + cf2_fixedAbs( OVERFLOW_SUB_INT32( vals[10], + *curX ) ) > + cf2_fixedAbs( OVERFLOW_SUB_INT32( vals[11], + *curY ) ) ); CF2_Fixed lastVal = cf2_stack_getReal( opStack, idx ); |