Commit 9ea83c788923f9d9ab966e77cb570a3f2be6a8d9
2017-07-07T17:09:43
[cff] Integer overflow. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2517 * src/cff/cf2blues.c (cf2_blues_capture): Use SUB_INT32.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45
diff --git a/ChangeLog b/ChangeLog
index 767309f..235e409 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2017-07-07 Werner Lemberg <wl@gnu.org>
+
+ [cff] Integer overflow.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2517
+
+ * src/cff/cf2blues.c (cf2_blues_capture): Use SUB_INT32.
+
2017-07-05 Werner Lemberg <wl@gnu.org>
* src/sfnt/ttcmap.c (tt_cmap_unicode_class_rec): Fix warning.
diff --git a/src/cff/cf2blues.c b/src/cff/cf2blues.c
index f9f5bbb..c491f2f 100644
--- a/src/cff/cf2blues.c
+++ b/src/cff/cf2blues.c
@@ -524,17 +524,18 @@
if ( !blues->zone[i].bottomZone && cf2_hint_isTop( topHintEdge ) )
{
- if ( ( SUB_INT32( blues->zone[i].csBottomEdge, csFuzz ) ) <=
- topHintEdge->csCoord &&
+ if ( SUB_INT32( blues->zone[i].csBottomEdge, csFuzz ) <=
+ topHintEdge->csCoord &&
topHintEdge->csCoord <=
- ADD_INT32( blues->zone[i].csTopEdge, csFuzz ) )
+ ADD_INT32( blues->zone[i].csTopEdge, csFuzz ) )
{
/* top edge captured by top zone */
if ( blues->suppressOvershoot )
dsNew = blues->zone[i].dsFlatEdge;
- else if ( ( topHintEdge->csCoord - blues->zone[i].csBottomEdge ) >=
+ else if ( SUB_INT32( topHintEdge->csCoord,
+ blues->zone[i].csBottomEdge ) >=
blues->blueShift )
{
/* guarantee minimum of 1 pixel overshoot */