Commit 7a4276fb9095430b86b329f52fb8dfe26f966dcd
2017-06-02T09:21:37
[cff] More integer overflows. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032 * src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54
diff --git a/ChangeLog b/ChangeLog
index 6194a2f..1b7335d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,15 @@
2017-06-02 Werner Lemberg <wl@gnu.org>
+ [cff] More integer overflows.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2032
+
+ * src/cff/cf2blues.c (cf2_blues_init): Use OVERFLOW_SUB_INT32.
+
+2017-06-02 Werner Lemberg <wl@gnu.org>
+
[bdf] Don't left-shift negative numbers.
Reported as
diff --git a/src/cff/cf2blues.c b/src/cff/cf2blues.c
index 141d0fc..950c714 100644
--- a/src/cff/cf2blues.c
+++ b/src/cff/cf2blues.c
@@ -301,7 +301,8 @@
/* top edge */
flatFamilyEdge = cf2_blueToFixed( familyOtherBlues[j + 1] );
- diff = cf2_fixedAbs( flatEdge - flatFamilyEdge );
+ diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge,
+ flatFamilyEdge ) );
if ( diff < minDiff && diff < csUnitsPerPixel )
{
@@ -319,7 +320,8 @@
/* top edge */
flatFamilyEdge = cf2_blueToFixed( familyBlues[1] );
- diff = cf2_fixedAbs( flatEdge - flatFamilyEdge );
+ diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge,
+ flatFamilyEdge ) );
if ( diff < minDiff && diff < csUnitsPerPixel )
blues->zone[i].csFlatEdge = flatFamilyEdge;
@@ -342,7 +344,8 @@
/* adjust edges of top zone upward by twice darkening amount */
flatFamilyEdge += 2 * font->darkenY; /* bottom edge */
- diff = cf2_fixedAbs( flatEdge - flatFamilyEdge );
+ diff = cf2_fixedAbs( OVERFLOW_SUB_INT32( flatEdge,
+ flatFamilyEdge ) );
if ( diff < minDiff && diff < csUnitsPerPixel )
{