shithub: freetype+ttf2subf

Info  •  Files  •  Log  •  Branches

Fix more 32bit issues (#54208)

* src/cff/cffload.c (cff_blend_build_vector): Convert assertion into
run-time error.

* src/truetype/ttgxvar.c (ft_var_to_normalized): Protect against
numeric overflow.

git/fs: mount .git/fs: mount/attach disallowed

--- a/ChangeLog

+++ b/ChangeLog

@@ -1,3 +1,13 @@

+2018-07-05  Werner Lemberg  <wl@gnu.org>

+

+	Fix more 32bit issues (#54208)

+

+	* src/cff/cffload.c (cff_blend_build_vector): Convert assertion into

+	run-time error.

+

+	* src/truetype/ttgxvar.c (ft_var_to_normalized): Protect against

+	numeric overflow.

+

 2018-07-04  Werner Lemberg  <wl@gnu.org>

 	Fix 32bit build warnings (#54239).

--- a/src/cff/cffload.c

+++ b/src/cff/cffload.c

@@ -1398,7 +1398,14 @@

     FT_UInt       master;

-    FT_ASSERT( lenNDV == 0 || NDV );

+    /* protect against malformed fonts */

+    if ( !( lenNDV == 0 || NDV ) )

+    {

+      FT_TRACE4(( " cff_blend_build_vector:"

+                  " Malformed Normalize Design Vector data\n" ));

+      error = FT_THROW( Invalid_File_Format );

+      goto Exit;

+    }

     blend->builtBV = FALSE;

--- a/src/truetype/ttgxvar.c

+++ b/src/truetype/ttgxvar.c

@@ -1780,11 +1780,11 @@

       }

       if ( coord < a->def )

-        normalized[i] = -FT_DivFix( coord - a->def,

-                                    a->minimum - a->def );

+        normalized[i] = -FT_DivFix( SUB_LONG( coord, a->def ),

+                                    SUB_LONG( a->minimum, a->def ) );

       else if ( coord > a->def )

-        normalized[i] = FT_DivFix( coord - a->def,

-                                   a->maximum - a->def );

+        normalized[i] = FT_DivFix( SUB_LONG( coord, a->def ),

+                                   SUB_LONG( a->maximum, a->def ) );

       else

         normalized[i] = 0;

     }