shithub: freetype+ttf2subf

Download patch

ref: 7bffeacd7ef77d050e8bcbbc4e4ab761fa7861b9
parent: 24848a3d58cdd3ffd40ef3ddd68407d18f678b52
author: Werner Lemberg <[email protected]>
date: Wed Jun 7 13:08:01 EDT 2017 

[cff, truetype] Integer overflows.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137

* src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.

* src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
OVERFLOW_SUB_LONG.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,20 @@
+2017-06-07  Werner Lemberg  <[email protected]>
+
+	[cff, truetype] Integer overflows.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2133
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2137
+
+	* src/cff/cf2hints.c (cf2_hint_init): Use OVERFLOW_SUB_INT32.
+
+	* src/truetype/ttinterp.c (PROJECT, DUALPROJ): Use
+	OVERFLOW_SUB_LONG.
+
 2017-06-06  Werner Lemberg  <[email protected]>
 
-	[cff] Integer overflow.
+	[cff] Integer overflows.
 
 	Reported as
 
--- a/src/cff/cf2hints.c
+++ b/src/cff/cf2hints.c
@@ -105,7 +105,7 @@
                                          stemHintArray,
                                          indexStemHint );
 
-    width = stemHint->max - stemHint->min;
+    width = OVERFLOW_SUB_INT32( stemHint->max, stemHint->min );
 
     if ( width == cf2_intToFixed( -21 ) )
     {
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -65,11 +65,15 @@
             TT_INTERPRETER_VERSION_40 )
 #endif
 
-#define PROJECT( v1, v2 )                                                \
-          exc->func_project( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
+#define PROJECT( v1, v2 )                                            \
+          exc->func_project( exc,                                    \
+                             OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                             OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
 
-#define DUALPROJ( v1, v2 )                                                \
-          exc->func_dualproj( exc, (v1)->x - (v2)->x, (v1)->y - (v2)->y )
+#define DUALPROJ( v1, v2 )                                            \
+          exc->func_dualproj( exc,                                    \
+                              OVERFLOW_SUB_LONG( (v1)->x, (v2)->x ),  \
+                              OVERFLOW_SUB_LONG( (v1)->y, (v2)->y ) )
 
 #define FAST_PROJECT( v )                          \
           exc->func_project( exc, (v)->x, (v)->y )