Commit 8ea854bfe92443706d55656072f891ec8f2cb3c2

Armin Hasitzka 2019-02-21T10:14:57

[truetype] Mask numeric overflows. * src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP): Mask numeric overflows. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734

diff --git a/ChangeLog b/ChangeLog
index cb17e77..40564a3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
 2019-02-21  Armin Hasitzka  <prince.cherusker@gmail.com>
 
+	[truetype] Mask numeric overflows.
+
+	* src/truetype/ttinterp.c (Move_CVT, Move_CVT_Stretched, Ins_MIRP):
+	Mask numeric overflows.
+
+	Reported as
+
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11681
+	  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11734
+
+2019-02-21  Armin Hasitzka  <prince.cherusker@gmail.com>
+
 	[psaux] Mask numeric overflow.
 
 	* src/psaux/cffdecode.c (cff_decoder_parse_charstrings): Mask numeric
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index fc8615b..90676b8 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -1564,7 +1564,7 @@
             FT_ULong        idx,
             FT_F26Dot6      value )
   {
-    exc->cvt[idx] += value;
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx], value );
   }
 
 
@@ -1573,7 +1573,8 @@
                       FT_ULong        idx,
                       FT_F26Dot6      value )
   {
-    exc->cvt[idx] += FT_DivFix( value, Current_Ratio( exc ) );
+    exc->cvt[idx] = ADD_LONG( exc->cvt[idx],
+                              FT_DivFix( value, Current_Ratio( exc ) );
   }
 
 
@@ -6311,7 +6312,7 @@
     if ( exc->GS.auto_flip )
     {
       if ( ( org_dist ^ cvt_dist ) < 0 )
-        cvt_dist = -cvt_dist;
+        cvt_dist = NEG_LONG( cvt_dist );
     }
 
 #ifdef TT_SUPPORT_SUBPIXEL_HINTING_INFINALITY