shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

Fix numeric overflows.

* src/pshint/pshalgo.c (psh_hint_align, psh_hint_align_light,
psh_hint_table_find_strong_points): Fix numeric overflows.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10083

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,14 @@

+2018-08-29  Armin Hasitzka  <[email protected]>

+

+	Fix numeric overflows.

+

+	* src/pshint/pshalgo.c (psh_hint_align, psh_hint_align_light,

+	psh_hint_table_find_strong_points): Fix numeric overflows.

+

+	Reported as

+

+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10083

+

 2018-08-29  Werner Lemberg  <[email protected]>

 	[cff] Fix handling of `roll' op in old engine.

--- a/src/pshinter/pshalgo.c

+++ b/src/pshinter/pshalgo.c

@@ -479,7 +479,7 @@

       if ( dimension == 1 )

         psh_blues_snap_stem( &globals->blues,

-                             hint->org_pos + hint->org_len,

+                             ADD_INT( hint->org_pos, hint->org_len ),

                              hint->org_pos,

                              &align );

@@ -703,7 +703,7 @@

       if ( dimension == 1 )

         psh_blues_snap_stem( &globals->blues,

-                             hint->org_pos + hint->org_len,

+                             ADD_INT( hint->org_pos, hint->org_len ),

                              hint->org_pos,

                              &align );

@@ -1538,8 +1538,8 @@

             PSH_Hint  hint = sort[nn];

-            if ( org_u >= hint->org_pos                 &&

-                org_u <= hint->org_pos + hint->org_len )

+            if ( org_u >=          hint->org_pos                  &&

+                 org_u <= ADD_INT( hint->org_pos, hint->org_len ) )

             {

               point->hint = hint;

               break;