shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

* src/sfnt/sfwoff2.c (compute_ULong_sum): Fix undefined shift.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16933

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,11 @@

+2019-09-03  Werner Lemberg  <[email protected]>

+

+	* src/sfnt/sfwoff2.c (compute_ULong_sum): Fix undefined shift.

+

+	Reported as

+

+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16933

+

 2019-09-01  Werner Lemberg  <[email protected]>

 	* src/sfnt/sfwoff2.c (woff2_open_font): Add sanity check.

--- a/src/sfnt/sfwoff2.c

+++ b/src/sfnt/sfwoff2.c

@@ -292,10 +292,10 @@

     for ( i = 0; i < aligned_size; i += 4 )

-      checksum += ( buf[i    ] << 24 ) |

-                  ( buf[i + 1] << 16 ) |

-                  ( buf[i + 2] <<  8 ) |

-                  ( buf[i + 3] <<  0 );

+      checksum += ( (FT_ULong)buf[i    ] << 24 ) |

+                  ( (FT_ULong)buf[i + 1] << 16 ) |

+                  ( (FT_ULong)buf[i + 2] <<  8 ) |

+                  ( (FT_ULong)buf[i + 3] <<  0 );

     /* If size is not aligned to 4, treat as if it is padded with 0s. */

     if ( size != aligned_size )