Commit bd9400bd464f6cd7c74f52ece1c1065fe2a87aab
2018-04-09T21:28:37
[truetype] Integer overflow issues. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7453 * src/truetype/ttinterp.c (Round_Super, Round_Super_45): Use ADD_LONG and SUB_LONG.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
diff --git a/ChangeLog b/ChangeLog
index 57540b4..01ed40e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2018-04-09 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Integer overflow issues.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=7453
+
+ * src/truetype/ttinterp.c (Round_Super, Round_Super_45): Use
+ ADD_LONG and SUB_LONG.
+
2018-04-06 Alexei Podtelezhnikov <apodtele@gmail.com>
[windows, wince] Clean up legacy project files.
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 240dae9..6a5b823 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -2165,7 +2165,7 @@
val = ADD_LONG( distance,
exc->threshold - exc->phase + compensation ) &
-exc->period;
- val += exc->phase;
+ val = ADD_LONG( val, exc->phase );
if ( val < 0 )
val = exc->phase;
}
@@ -2174,7 +2174,7 @@
val = NEG_LONG( SUB_LONG( exc->threshold - exc->phase + compensation,
distance ) &
-exc->period );
- val -= exc->phase;
+ val = SUB_LONG( val, exc->phase );
if ( val > 0 )
val = -exc->phase;
}
@@ -2216,7 +2216,7 @@
val = ( ADD_LONG( distance,
exc->threshold - exc->phase + compensation ) /
exc->period ) * exc->period;
- val += exc->phase;
+ val = ADD_LONG( val, exc->phase );
if ( val < 0 )
val = exc->phase;
}
@@ -2225,7 +2225,7 @@
val = NEG_LONG( ( SUB_LONG( exc->threshold - exc->phase + compensation,
distance ) /
exc->period ) * exc->period );
- val -= exc->phase;
+ val = SUB_LONG( val, exc->phase );
if ( val > 0 )
val = -exc->phase;
}