shithub: freetype+ttf2subf

Download patch

ref: 7e1b39f6cd1f8e14d45592c9b192ade643d8d9de
parent: 0c14a3adb08ca5aaac3188a63246361c50b069d4
author: Werner Lemberg <[email protected]>
date: Mon Dec 16 06:07:58 EST 2019 

[truetype] Fix UBSan warnings on adding offsets to nullptr.

Reported as

  https://bugs.chromium.org/p/chromium/issues/detail?id=1032152

* src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-12-16  Werner Lemberg  <[email protected]>
+
+	[truetype] Fix UBSan warnings on adding offsets to nullptr.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/chromium/issues/detail?id=1032152
+
+	* src/truetype/ttinterp.c (Ins_FDEF, Ins_IDEF): Use `FT_OFFSET'.
+
 2019-12-14  Werner Lemberg  <[email protected]>
 
 	[truetype] Fix integer overflow.
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -3718,7 +3718,7 @@
     /* We will then parse the current table.                       */
 
     rec   = exc->FDefs;
-    limit = rec + exc->numFDefs;
+    limit = FT_OFFSET( rec, exc->numFDefs );
     n     = (FT_ULong)args[0];
 
     for ( ; rec < limit; rec++ )
@@ -4150,7 +4150,7 @@
     /*  First of all, look for the same function in our table */
 
     def   = exc->IDefs;
-    limit = def + exc->numIDefs;
+    limit = FT_OFFSET( def, exc->numIDefs );
 
     for ( ; def < limit; def++ )
       if ( def->opc == (FT_ULong)args[0] )