shithub: freetype+ttf2subf

Download patch

ref: 933f4cbe792b777b826282dba9e55edb7b22a14d
parent: 38bdf22bfe68432aebdd33c198a0bd11b4ebb96f
author: Werner Lemberg <[email protected]>
date: Wed Jul 26 19:32:32 EDT 2017 

[cff] Integer overflow.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2738

* src/cff/cf2hints.c (cf2_glyphpath_computeOffset,
cf2_glyphpath_curveTo): Use ADD_INT32.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2017-07-26  Werner Lemberg  <[email protected]>
+
+	[cff] Integer overflow.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2738
+
+	* src/cff/cf2hints.c (cf2_glyphpath_computeOffset,
+	cf2_glyphpath_curveTo): Use ADD_INT32.
+
 2017-07-13  Werner Lemberg  <[email protected]>
 
 	[base] Fix memory leak.
--- a/src/cff/cf2hints.c
+++ b/src/cff/cf2hints.c
@@ -1489,8 +1489,9 @@
         return;
 
     /* add momentum for this path element */
-    glyphpath->callbacks->windingMomentum +=
-      cf2_getWindingMomentum( x1, y1, x2, y2 );
+    glyphpath->callbacks->windingMomentum =
+      ADD_INT32( glyphpath->callbacks->windingMomentum,
+                 cf2_getWindingMomentum( x1, y1, x2, y2 ) );
 
     /* note: allow mixed integer and fixed multiplication here */
     if ( dx >= 0 )
@@ -1778,8 +1779,9 @@
                                  &yOffset3 );
 
     /* add momentum from the middle segment */
-    glyphpath->callbacks->windingMomentum +=
-      cf2_getWindingMomentum( x1, y1, x2, y2 );
+    glyphpath->callbacks->windingMomentum =
+      ADD_INT32( glyphpath->callbacks->windingMomentum,
+                 cf2_getWindingMomentum( x1, y1, x2, y2 ) );
 
     /* construct offset points */
     P0.x = ADD_INT32( glyphpath->currentCS.x, xOffset1 );