shithub: freetype+ttf2subf

Download patch

ref: ba62f9d8f5f85c6dda93b481271de37fb1f09e77
parent: acb19ed4e9c0cf1339e240069a252b9080dcb31e
author: Werner Lemberg <[email protected]>
date: Mon Oct 29 17:11:36 EDT 2018 

[cff] Fix numeric overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988

* src/cff/cffparse.c (cff_parser_run)
[CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2018-10-29  Werner Lemberg  <[email protected]>
+
+	[cff] Fix numeric overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10988
+
+	* src/cff/cffparse.c (cff_parser_run)
+	[CFF_CONFIG_OPTION_OLD_ENGINE]: Use `NEG_LONG'.
+
 2018-10-27  Alexei Podtelezhnikov  <[email protected]>
 
 	[sfnt] Make `head' timestamps unsigned.
--- a/src/cff/cffparse.c
+++ b/src/cff/cffparse.c
@@ -1259,7 +1259,7 @@
 
           if ( *stack < 0 )
           {
-            num = (FT_ULong)-*stack;
+            num = (FT_ULong)NEG_LONG( *stack );
             neg = 1;
           }
           else