Commit dde8f5abbe5a27af2186c3f0e2c702612d7ca930
2017-06-27T06:16:04
[truetype] Integer overflows. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2384 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2391 * src/base/ftcalc.c (FT_MulDiv, FT_MulDiv_No_Round, FT_DivFix): Use NEG_LONG. * src/truetype/ttinterp.c (Ins_SxVTL): Use NEG_LONG.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106
diff --git a/ChangeLog b/ChangeLog
index f992e06..f79ab73 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,17 @@
+2017-06-27 Werner Lemberg <wl@gnu.org>
+
+ [truetype] Integer overflows.
+
+ Reported as
+
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2384
+ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2391
+
+ * src/base/ftcalc.c (FT_MulDiv, FT_MulDiv_No_Round, FT_DivFix): Use
+ NEG_LONG.
+
+ * src/truetype/ttinterp.c (Ins_SxVTL): Use NEG_LONG.
+
2017-06-24 Werner Lemberg <wl@gnu.org>
[truetype] Integer overflows.
diff --git a/src/base/ftcalc.c b/src/base/ftcalc.c
index cb10612..f27fcfd 100644
--- a/src/base/ftcalc.c
+++ b/src/base/ftcalc.c
@@ -193,7 +193,7 @@
d_ = (FT_Long)d;
- return s < 0 ? -d_ : d_;
+ return s < 0 ? NEG_LONG( d_ ) : d_;
}
@@ -222,7 +222,7 @@
d_ = (FT_Long)d;
- return s < 0 ? -d_ : d_;
+ return s < 0 ? NEG_LONG( d_ ) : d_;
}
@@ -269,7 +269,7 @@
q_ = (FT_Long)q;
- return s < 0 ? -q_ : q_;
+ return s < 0 ? NEG_LONG( q_ ) : q_;
}
@@ -456,7 +456,7 @@
a_ = (FT_Long)a;
- return s < 0 ? -a_ : a_;
+ return s < 0 ? NEG_LONG( a_ ) : a_;
}
@@ -499,7 +499,7 @@
a_ = (FT_Long)a;
- return s < 0 ? -a_ : a_;
+ return s < 0 ? NEG_LONG( a_ ) : a_;
}
@@ -595,7 +595,7 @@
a_ = (FT_Long)a;
- return s < 0 ? -a_ : a_;
+ return s < 0 ? NEG_LONG( a_ ) : a_;
#endif /* 0 */
@@ -648,7 +648,7 @@
q_ = (FT_Long)q;
- return s < 0 ? -q_ : q_;
+ return s < 0 ? NEG_LONG( q_ ) : q_;
}
diff --git a/src/truetype/ttinterp.c b/src/truetype/ttinterp.c
index 8e7809a..24318bf 100644
--- a/src/truetype/ttinterp.c
+++ b/src/truetype/ttinterp.c
@@ -4260,9 +4260,9 @@
if ( ( opcode & 1 ) != 0 )
{
- C = B; /* counter clockwise rotation */
- B = A;
- A = -C;
+ C = B; /* counter clockwise rotation */
+ B = A;
+ A = NEG_LONG( C );
}
Normalize( A, B, Vec );