[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freetype2] master b27cef2: [truetype] Integer overflows.
From: |
Werner LEMBERG |
Subject: |
[freetype2] master b27cef2: [truetype] Integer overflows. |
Date: |
Sat, 24 Jun 2017 14:18:00 -0400 (EDT) |
branch: master
commit b27cef27ffc37cb14190a1860523d6a1aa9bc783
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>
[truetype] Integer overflows.
Reported as
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2364
* src/truetype/ttinterp.c (Ins_ISECT): Use NEG_LONG.
---
ChangeLog | 10 ++++++++++
src/truetype/ttinterp.c | 4 ++--
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index f40f4db..f992e06 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2017-06-24 Werner Lemberg <address@hidden>
+
+ [truetype] Integer overflows.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2364
+
+ * src/truetype/ttinterp.c (Ins_ISECT): Use NEG_LONG.
+
2017-06-22 Werner Lemberg <address@hidden>
[cff, truetype] Integer overflows.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index a032923..8e7809a 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -6487,7 +6487,7 @@
dx = SUB_LONG( exc->zp0.cur[b0].x, exc->zp1.cur[a0].x );
dy = SUB_LONG( exc->zp0.cur[b0].y, exc->zp1.cur[a0].y );
- discriminant = ADD_LONG( FT_MulDiv( dax, -dby, 0x40 ),
+ discriminant = ADD_LONG( FT_MulDiv( dax, NEG_LONG( dby ), 0x40 ),
FT_MulDiv( day, dbx, 0x40 ) );
dotproduct = ADD_LONG( FT_MulDiv( dax, dbx, 0x40 ),
FT_MulDiv( day, dby, 0x40 ) );
@@ -6502,7 +6502,7 @@
/* thresholding abs(tan(angle)) at 1/19, corresponding to 3 degrees. */
if ( MUL_LONG( 19, FT_ABS( discriminant ) ) > FT_ABS( dotproduct ) )
{
- val = ADD_LONG( FT_MulDiv( dx, -dby, 0x40 ),
+ val = ADD_LONG( FT_MulDiv( dx, NEG_LONG( dby ), 0x40 ),
FT_MulDiv( dy, dbx, 0x40 ) );
R.x = FT_MulDiv( val, dax, discriminant );
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [freetype2] master b27cef2: [truetype] Integer overflows.,
Werner LEMBERG <=