ref: 5b904409fc3ee6de45b60df722f95c6499951c2f
parent: 88c0e12109f4059b8ce45797c71b50218c141462
author: Werner Lemberg <[email protected]>
date: Sat Aug 11 02:41:35 EDT 2018
* src/base/ftcalc.c (FT_Matrix_Check): Fix integer overflow. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9811
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2018-08-11 Werner Lemberg <[email protected]>
+
+ * src/base/ftcalc.c (FT_Matrix_Check): Fix integer overflow.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9811
+
2018-08-10 Alexei Podtelezhnikov <[email protected]>
* src/sfnt/ttsbit.c (tt_sbit_decoder_load_compound): Follow specs.
--- a/include/freetype/freetype.h
+++ b/include/freetype/freetype.h
@@ -4669,6 +4669,11 @@
* This section contains various functions used to perform
* computations on 16.16 fixed-float numbers or 2d vectors.
*
+ * *Attention*: Most arithmetic functions take `FT_Long' as arguments.
+ * For historical reasons, FreeType was designed under the assumption
+ * that `FT_Long' is a 32-bit integer; results can thus be undefined
+ * if the arguments don't fit into 32 bits.
+ *
* @order:
* FT_MulDiv
* FT_MulFix
--- a/src/base/ftcalc.c
+++ b/src/base/ftcalc.c
@@ -701,8 +701,8 @@
if ( !delta )
return FT_THROW( Invalid_Argument ); /* matrix can't be inverted */
- matrix->xy = - FT_DivFix( matrix->xy, delta );
- matrix->yx = - FT_DivFix( matrix->yx, delta );
+ matrix->xy = -FT_DivFix( matrix->xy, delta );
+ matrix->yx = -FT_DivFix( matrix->yx, delta );
xx = matrix->xx;
yy = matrix->yy;
@@ -783,6 +783,10 @@
if ( val[i] && val[i] < nonzero_minval )
nonzero_minval = val[i];
}
+
+ /* we only handle 32bit values */
+ if ( maxval > 0x7FFFFFFFL )
+ return 0;
if ( maxval > 23170 )
{