ref: cd02d359a6d0455e9d16b87bf9665961c4699538
parent: a607e3919d2445942ca58b126b060b262e023e16
author: Werner Lemberg <[email protected]>
date: Thu Jun 1 13:05:39 EDT 2017
[smooth] Some 32bit integer overflow run-time errors. * src/smooth/ftgrays.c [STANDALONE] (OVERFLOW_ADD_LONG, OVERFLOW_SUB_LONG, OVERFLOW_MUL_LONG, NEG_LONG): New macros. [!STANDALONE]: Include FT_INTERNAL_CALC_H. (gray_render_cubic): Use those macros where appropriate.
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
2017-06-01 Werner Lemberg <[email protected]>
+ [smooth] Some 32bit integer overflow run-time errors.
+
+ * src/smooth/ftgrays.c [STANDALONE] (OVERFLOW_ADD_LONG,
+ OVERFLOW_SUB_LONG, OVERFLOW_MUL_LONG, NEG_LONG): New macros.
+ [!STANDALONE]: Include FT_INTERNAL_CALC_H.
+ (gray_render_cubic): Use those macros where appropriate.
+
+2017-06-01 Werner Lemberg <[email protected]>
+
* src/base/ftglyph.c (FT_Get_Glyph): Check `slot->advance'.
2017-06-01 Werner Lemberg <[email protected]>
--- a/src/smooth/ftgrays.c
+++ b/src/smooth/ftgrays.c
@@ -141,6 +141,16 @@
#define FT_INT_MAX INT_MAX
#define FT_ULONG_MAX ULONG_MAX
+#define OVERFLOW_ADD_LONG( a, b ) \
+ (long)( (unsigned long)(a) + (unsigned long)(b) )
+#define OVERFLOW_SUB_LONG( a, b ) \
+ (long)( (unsigned long)(a) - (unsigned long)(b) )
+#define OVERFLOW_MUL_LONG( a, b ) \
+ (long)( (unsigned long)(a) * (unsigned long)(b) )
+#define NEG_LONG( a ) \
+ (long)( -(unsigned long)(a) )
+
+
#define ft_memset memset
#define ft_setjmp setjmp
@@ -264,6 +274,7 @@
#include "ftgrays.h"
#include FT_INTERNAL_OBJECTS_H
#include FT_INTERNAL_DEBUG_H
+#include FT_INTERNAL_CALC_H
#include FT_OUTLINE_H
#include "ftsmerrs.h"
@@ -1135,7 +1146,8 @@
/* s is L * the perpendicular distance from P1 to the line P0-P3. */
dx1 = arc[1].x - arc[0].x;
dy1 = arc[1].y - arc[0].y;
- s = FT_ABS( dy * dx1 - dx * dy1 );
+ s = FT_ABS( OVERFLOW_SUB_LONG( OVERFLOW_MUL_LONG( dy, dx1 ),
+ OVERFLOW_MUL_LONG( dx, dy1 ) ) );
if ( s > s_limit )
goto Split;
@@ -1143,7 +1155,8 @@
/* s is L * the perpendicular distance from P2 to the line P0-P3. */
dx2 = arc[2].x - arc[0].x;
dy2 = arc[2].y - arc[0].y;
- s = FT_ABS( dy * dx2 - dx * dy2 );
+ s = FT_ABS( OVERFLOW_SUB_LONG( OVERFLOW_MUL_LONG( dy, dx2 ),
+ OVERFLOW_MUL_LONG( dx, dy2 ) ) );
if ( s > s_limit )
goto Split;