shithub: freetype+ttf2subf

Download patch

ref: d1180b5f9598088ab1bc9d772e5e09ece0702a38
parent: 4d364b68215f1380b66164f3f0e4bdadc154d08f
author: Werner Lemberg <[email protected]>
date: Fri Jun 19 04:18:26 EDT 2020 

[base] Fix UBSAN error.

Reported as

  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166

* src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
larger than 32 bits.

git/fs: mount .git/fs: mount/attach disallowed 
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
 2020-06-19  Werner Lemberg  <[email protected]>
 
+	[base] Fix UBSAN error.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23166
+
+	* src/base/ftoutln.c (FT_Outline_Get_Orientation): Avoid values
+	larger than 32 bits.
+
+2020-06-19  Werner Lemberg  <[email protected]>
+
 	[woff2] Fix segfault.
 
 	Reported as
--- a/src/base/ftoutln.c
+++ b/src/base/ftoutln.c
@@ -1060,6 +1060,13 @@
     if ( cbox.xMin == cbox.xMax || cbox.yMin == cbox.yMax )
       return FT_ORIENTATION_NONE;
 
+    /* Reject values larger than 32bit. */
+    if ( (unsigned long)cbox.xMin > 0xFFFFFFFFUL ||
+         (unsigned long)cbox.xMax > 0xFFFFFFFFUL ||
+         (unsigned long)cbox.yMin > 0xFFFFFFFFUL ||
+         (unsigned long)cbox.yMax > 0xFFFFFFFFUL )
+      return FT_ORIENTATION_NONE;
+
     xshift = FT_MSB( (FT_UInt32)( FT_ABS( cbox.xMax ) |
                                   FT_ABS( cbox.xMin ) ) ) - 14;
     xshift = FT_MAX( xshift, 0 );