shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

[cff] Integer overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2517

* src/cff/cf2blues.c (cf2_blues_capture): Use SUB_INT32.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,13 @@

+2017-07-07  Werner Lemberg  <[email protected]>

+

+	[cff] Integer overflow.

+

+	Reported as

+

+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2517

+

+	* src/cff/cf2blues.c (cf2_blues_capture): Use SUB_INT32.

+

 2017-07-05  Werner Lemberg  <[email protected]>

 	* src/sfnt/ttcmap.c (tt_cmap_unicode_class_rec): Fix warning.

--- a/src/cff/cf2blues.c

+++ b/src/cff/cf2blues.c

@@ -524,10 +524,10 @@

       if ( !blues->zone[i].bottomZone && cf2_hint_isTop( topHintEdge ) )

       {

-        if ( ( SUB_INT32( blues->zone[i].csBottomEdge, csFuzz ) ) <=

-               topHintEdge->csCoord                                  &&

+        if ( SUB_INT32( blues->zone[i].csBottomEdge, csFuzz ) <=

+               topHintEdge->csCoord                              &&

              topHintEdge->csCoord <=

-               ADD_INT32( blues->zone[i].csTopEdge, csFuzz )         )

+               ADD_INT32( blues->zone[i].csTopEdge, csFuzz )     )

         {

           /* top edge captured by top zone */

@@ -534,7 +534,8 @@

           if ( blues->suppressOvershoot )

             dsNew = blues->zone[i].dsFlatEdge;

-          else if ( ( topHintEdge->csCoord - blues->zone[i].csBottomEdge ) >=

+          else if ( SUB_INT32( topHintEdge->csCoord,

+                               blues->zone[i].csBottomEdge ) >=

                       blues->blueShift )

           {

             /* guarantee minimum of 1 pixel overshoot */