shithub: freetype+ttf2subf

Download patch

ref: 8ea854bfe92443706d55656072f891ec8f2cb3c2
parent: 5e3a38b194f3a68e9a5a03a1bd0c6bb2eb3dec1f
author: Armin Hasitzka <[email protected]>
date: Thu Feb 21 05:14:57 EST 2019 

[truetype] Mask numeric overflows.

* src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP):
Mask numeric overflows.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
 2019-02-21  Armin Hasitzka  <[email protected]>
 
+	[truetype] Mask numeric overflows.
+
+	* src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP):
+	Mask numeric overflows.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734
+
+2019-02-21  Armin Hasitzka  <[email protected]>
+
 	[psaux] Mask numeric overflow.
 
 	* src/psaux/cffdecode.c (cff_decoder_parse_charstrings): Mask numeric
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -1564,7 +1564,7 @@
             FT_ULong        idx,
             FT_F26Dot6      value )
   {
-    exc->cvt[idx] += value;
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx], value );
   }
 
 
@@ -1573,7 +1573,8 @@
                       FT_ULong        idx,
                       FT_F26Dot6      value )
   {
-    exc->cvt[idx] += FT_DivFix( value, Current_Ratio( exc ) );
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx],
+                              FT_DivFix( value, Current_Ratio( exc ) );
   }
 
 
@@ -6311,7 +6312,7 @@
     if ( exc->GS.auto_flip )
     {
       if ( ( org_dist ^ cvt_dist ) < 0 )
-        cvt_dist = -cvt_dist;
+        cvt_dist = NEG_LONG( cvt_dist );
     }
 
 #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY